Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
173 detections
Filters
Last updated
All Time
Detection languages
81
28
22
18
8
Contributors
67
51
14
12
6
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
168
9
2
Products / Services
150
137
129
5
4
MITRE Techniques
99
90
40
29
22
CVEs
3
2
1
1
IDS Classtypes
3
1
1
IDS Protocols
3
2
Detects anomalous Kerberos ticket requests observed by ADAudit Plus. Service ticket
harvesting — one account requesting tickets for many services in quick succession —
is the precursor to offline cracking of service account credentials, and it is quiet
at the domain controller unless something is watching for the pattern.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=win-audit where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='KERBEROS_AUTHENTICATION_TICKET_REQUESTED'
| duration 1h
| groupby user, domain
| select user, domain, count(*) as cnt
| having cnt > 20
harvesting — one account requesting tickets for many services in quick succession —
is the precursor to offline cracking of service account credentials, and it is quiet
at the domain controller unless something is watching for the pattern.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=win-audit where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='KERBEROS_AUTHENTICATION_TICKET_REQUESTED'
| duration 1h
| groupby user, domain
| select user, domain, count(*) as cnt
| having cnt > 20
Detects Kerberos service ticket requests observed in network traffic analysis.
Seeing this on the wire rather than at the domain controller catches harvesting even
where domain controller auditing is incomplete, and it gives the source address
directly rather than requiring correlation.
Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=nta-connection where sourcename='NTA'
and action='KERBEROS_SERVICE_TICKET_REQUESTED'
| duration 1h
| groupby srcip, dstip
| select srcip, dstip, count(*) as cnt
| having cnt > 20
Seeing this on the wire rather than at the domain controller catches harvesting even
where domain controller auditing is incomplete, and it gives the source address
directly rather than requiring correlation.
Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=nta-connection where sourcename='NTA'
and action='KERBEROS_SERVICE_TICKET_REQUESTED'
| duration 1h
| groupby srcip, dstip
| select srcip, dstip, count(*) as cnt
| having cnt > 20
The following analytic detects potential Kerberoasting attacks by identifying Kerberos service ticket requests with RC4 encryption through Event ID 4769. It leverages specific Ticket_Options values commonly used by Kerberoasting tools. This activity is significant as Kerberoasting allows attackers to request service tickets for domain accounts, typically service accounts, and crack them offline to gain privileged access. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and further compromise of the Active Directory environment.
The following analytic detects the execution of the `Get-DomainSPNTicket` commandlet, part of the PowerView tool, by leveraging PowerShell Script Block Logging (EventCode=4104). This commandlet requests Kerberos service tickets for specified service principal names (SPNs). Monitoring this activity is crucial as it can indicate attempts to perform Kerberoasting, a technique used to extract SPN account passwords via cracking tools like hashcat. If confirmed malicious, this activity could allow attackers to gain unauthorized access to sensitive accounts, potentially leading to privilege escalation and further network compromise.
Detects Kerberos TGS requests using RC4 encryption (0x17), which is a common indicator of Kerberoasting. By monitoring Event IDs 4768 and 4769 for this specific encryption type, this rule identifies potential attempts to offline-crack service account passwords.
Detects high volumes of TGS-REQ events using RC4 encryption (etype 0x17) originating from a single account within a 10-minute window, excluding known service accounts and computer accounts. This pattern is often indicative of an adversary attempting to harvest service account tickets for offline brute-force cracking.
This rule detects potential Golden Ticket activity by identifying Kerberos TGS requests (Event ID 4769) that lack a corresponding prior TGT request (Event ID 4768) for the same user and IP address. This behavior is characteristic of offline forged Kerberos tickets where an attacker uses a compromised KRBTGT hash to create authentication tickets without interacting with the Key Distribution Center for the initial TGT.
Detects anomalous Kerberos Ticket Granting Service (TGS) requests from a single user account and IP within a 10-minute window. It specifically flags accounts requesting a high volume of TGS tickets or accessing multiple distinct services, where the tickets use RC4 encryption (0x17), which is a characteristic of Kerberoasting attacks targeting service accounts.
This rule identifies suspicious Kerberos activity indicative of Golden or Silver Ticket attacks. It monitors for service ticket (4769) requests that occur without a preceding TGT request (4768) within a specified window, detects RC4 encryption downgrades on Kerberos requests in environments expected to use AES, and identifies tickets containing non-standard TicketOptions commonly associated with automated forgery tools like Mimikatz.
Detects anomalous Kerberos TGT (4768) or TGS (4769) requests where the ticket lifetime exceeds typical domain policy (10 hours), or where the KRBTGT account is explicitly referenced as the target, both of which are high-fidelity indicators of Golden Ticket forgery attacks.
Detects Kerberos TGT (4768) or TGS (4769) tickets that exhibit anomalous characteristics often associated with forged tickets (e.g., Golden Ticket). The rule flags tickets using weak encryption (RC4-HMAC, legacy DES), tickets requested for stale/disabled accounts, or tickets with lifetimes exceeding standard domain policy thresholds.
Detects a hybrid identity attack sequence where an anomalous or high-risk cloud sign-in (e.g., AD FS, Azure AD Connect) is followed within 24 hours by suspicious on-premise Active Directory activity, specifically DCSync replication requests or Kerberoasting (high volume of TGS requests). This pattern is indicative of an attacker leveraging stolen cloud session tokens to pivot into on-premise infrastructure.
This rule detects instances of Kerberos Ticket-Granting Ticket (TGT) requests (Event IDs 4768 and 4769) that utilize the legacy RC4 encryption type (0x17). In modern Active Directory environments where AES is the standard for Kerberos, the use of RC4 can be a strong indicator of a Golden Ticket attack or other unauthorized ticket forging activities, as adversaries often force a downgrade to RC4 for easier offline cracking.
Detects anomalous Kerberos service ticket (TGS) requests or successful logons where the corresponding Ticket Granting Ticket (TGT) request (Event ID 4768) is absent within the monitored window. This pattern is a primary indicator of offline-forged Kerberos tickets, such as those generated by Mimikatz, which bypass legitimate KDC interaction for ticket issuance.
Detects anomalous Kerberos TGS ticket requests (Event ID 4769) where a single user requests tickets for multiple distinct Service Principal Names (SPNs) using weak RC4 (0x17) encryption. This behavior is highly characteristic of Kerberoasting, a technique used by adversaries to harvest service account tickets for offline cracking.
This rule detects the use of forged Kerberos Ticket-Granting Tickets (Golden Tickets), which are typically generated by abusing the KRBTGT account's NTLM hash. The rule monitors Windows Event IDs 4768 and 4769 for anomalies including excessively long ticket lifetimes (common in Mimikatz outputs), evidence of tickets used post-KRBTGT reset, or tickets issued for accounts that do not exist in the environment.
Detects potential credential dumping activity via DCSync, identified by a non-DC computer account performing directory replication (DRS GetNCChanges), correlated with subsequent suspicious Kerberos ticket requests (Event ID 4769) that utilize weak encryption (RC4 or legacy DES), which is often associated with Golden Ticket abuse.
Detects potential Golden Ticket forgery or malicious Kerberos activity by monitoring Windows Security Event IDs 4768 (TGT) and 4769 (TGS). The rule identifies suspicious characteristics including the use of weak encryption (RC4) where AES is preferred, specific ticket option flags commonly associated with Mimikatz, and unusually long ticket lifetimes that deviate from standard domain policies.
This rule detects potential AS-REP Roasting attempts by identifying an unusually high volume of Kerberos AS-REQ requests (Event ID 4768) where the preauthentication type is set to 0. These requests are grouped by source IP or client address, and alerts are triggered when the number of unique accounts targeted or the total request count exceeds defined thresholds. AS-REP Roasting is an attack technique that attempts to retrieve a TGT for user accounts that have Kerberos preauthentication disabled, making them susceptible to offline brute-force password cracking.
This rule detects potential Kerberoasting activity by monitoring Kerberos TGS requests (Event ID 4769) that use RC4 encryption (0x17 or 17). It identifies accounts requesting TGS tickets for a large number of unique Service Principal Names (SPNs), excluding requests for host-based services (ending in $). High volumes of such requests from a single user are indicative of an attempt to gather service tickets for offline password cracking.
This rule detects potential AS-REP Roasting attempts by identifying an unusually high volume of Kerberos AS-REQ requests (Event ID 4768) where the preauthentication type is set to 0. These requests are grouped by source IP or client address, and alerts are triggered when the number of unique accounts targeted or the total request count exceeds defined thresholds. AS-REP Roasting is an attack technique that attempts to retrieve a TGT for user accounts that have Kerberos preauthentication disabled, making them susceptible to offline brute-force password cracking.
Page 1 of 9