Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
173 detections
Filters
Last updated
All Time
Detection languages
81
28
22
18
8
Contributors
67
51
14
12
6
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
168
9
2
Products / Services
150
137
129
5
4
MITRE Techniques
99
90
40
29
22
CVEs
3
2
1
1
IDS Classtypes
3
1
1
IDS Protocols
3
2
Detects Kerberoasting activity by identifying a high volume of RC4-encrypted (0x17) Kerberos Service Ticket (TGS) requests from a single user account against multiple distinct service principal names (SPNs) within a short timeframe. This behavior is highly indicative of automated credential harvesting tools such as Rubeus or Impacket.
Detects anomalous Kerberos TGS (Ticket Granting Service) requests using weak RC4-HMAC (0x17) encryption. The rule looks for accounts requesting multiple service tickets for distinct Service Principal Names (SPNs) within a short time window, which is a common behavior pattern for tools like Rubeus or GetUserSPNs.py during the credential-harvesting phase of a Kerberoasting attack.
Detects Kerberos TGT or TGS requests that either exhibit a suspicious combination of ticket flags (Forwardable + Proxiable + Renewable) when associated with high-value targets, unusual accounts, or off-hours activity, or utilize the weak RC4-HMAC encryption type, both of which are indicative of ticket manipulation and credential theft.
This rule detects instances where a Kerberos Service Ticket (TGS, Event ID 4769) is requested without a corresponding TGT request (AS-REQ, Event ID 4768) from the same user and IP address within a 10-hour window. This behavior is indicative of potential Kerberoasting, where an attacker may have obtained TGS tickets using cached or manually constructed credentials rather than through the normal authentication flow.
This rule detects potential extraction or caching of Kerberos Ticket-Granting Tickets (TGT) by correlating Kerberos authentication events (4768/4769) with unauthorized access to the Local Security Authority Subsystem Service (lsass.exe). This pattern is often indicative of credential dumping tools like Mimikatz targeting Kerberos tickets on systems potentially used for delegation attacks.
Detects Kerberos TGT or TGS requests that either exhibit a suspicious combination of ticket flags (Forwardable + Proxiable + Renewable) when associated with high-value targets, unusual accounts, or off-hours activity, or utilize the weak RC4-HMAC encryption type, both of which are indicative of ticket manipulation and credential theft.
Detects Kerberos TGT or TGS requests that either exhibit a suspicious combination of ticket flags (Forwardable + Proxiable + Renewable) when associated with high-value targets, unusual accounts, or off-hours activity, or utilize the weak RC4-HMAC encryption type, both of which are indicative of ticket manipulation and credential theft.
Detects Kerberos TGT or TGS requests that either exhibit a suspicious combination of ticket flags (Forwardable + Proxiable + Renewable) when associated with high-value targets, unusual accounts, or off-hours activity, or utilize the weak RC4-HMAC encryption type, both of which are indicative of ticket manipulation and credential theft.
Detects Kerberos TGT or TGS requests that either exhibit a suspicious combination of ticket flags (Forwardable + Proxiable + Renewable) when associated with high-value targets, unusual accounts, or off-hours activity, or utilize the weak RC4-HMAC encryption type, both of which are indicative of ticket manipulation and credential theft.
Detects Kerberos Ticket Granting Service (TGS) requests (Event ID 4769) that use RC4 encryption (0x17). In modern Active Directory environments, RC4 is considered weak and is often explicitly requested by attackers during Kerberoasting to facilitate offline brute-force cracking of service account passwords. The rule excludes common service accounts (e.g., krbtgt, machine accounts) to reduce noise.
Kerberos TGT Request Anomaly Detection
Cortex XDR
This rule detects potential indicators of forged Kerberos Ticket Granting Tickets (Golden Tickets). It monitors Kerberos authentication events (4768 and 4769) for specific anomalies, including ticket requests for non-existent accounts (Status 0x6), suspicious service requests (krbtgt with RC4 encryption), and abnormal ticket option usage, which are common artifacts of credential manipulation and forgery.
AS-REP Roasting Potential Enumeration
Cortex XDR
Detects Kerberos AS-REQ events (Event ID 4768) where accounts with Kerberos pre-authentication disabled successfully request an AS-REP ticket. Attackers exploit these accounts by requesting encrypted AS-REP blobs to perform offline password cracking. The rule flags potential enumeration when multiple unique accounts are targeted from the same source within a short timeframe.
Detects a potential Kerberoasting attempt by identifying a single user or IP requesting multiple RC4-encrypted Ticket Granting Service (TGS) tickets for distinct service accounts within a short timeframe. Kerberoasting involves requesting TGS tickets for service accounts, which are then used for offline brute-force cracking of the service account's password hash.
Detects successful Kerberos PKINIT authentication (Event 4768, PreAuthType 16) issued by on-premises certificate authorities. This activity is a potential indicator of Shadow Credentials or Active Directory Certificate Services (AD CS) abuse where attackers use forged or stolen certificates to authenticate as domain users or machines.
Detects Kerberos TGT requests (Event ID 4768) that utilize RC4 (PreAuthType 23) for pre-authentication. This is a common indicator of an Overpass-the-Hash attack, where an adversary uses a stolen NTLM hash to authenticate as a user and request a Kerberos ticket in environments that are typically configured for AES encryption.
Shows all Kerberos authentication activity on domain controllers - TGT requests, TGS requests, and pre-auth failures (4768/4769/4771). Good for hunting credential attacks, AS-REP roasting, weak encryption usage, and account lockout troubleshooting.
This rule detects Kerberos Service Ticket (TGS) requests made for the 'AZUREADSSOACC$' computer account, which is typically used for Seamless Single Sign-On (SSO) in hybrid Azure AD environments. The rule explicitly excludes known Domain Controllers from triggering the alert to focus on potentially suspicious TGS requests originating from other systems.
This rule monitors Kerberos TGS (Ticket-Granting Service) requests for suspicious patterns indicative of Kerberoasting, specifically looking for the use of weak encryption algorithms (RC4 or DES) and high volumes of service ticket requests for unique Service Principal Names (SPNs). It groups activity by source host and time window, flagging activity that involves DES encryption or a significant number of unique SPN requests. Great for detecting kerberoasting activity from unmanaged or rogue devices
This rule detects Kerberos Service Ticket (TGS) requests made for the 'AZUREADSSOACC$' computer account, which is typically used for Seamless Single Sign-On (SSO) in hybrid Azure AD environments. The rule explicitly excludes known Domain Controllers from triggering the alert to focus on potentially suspicious TGS requests originating from other systems.
This rule monitors Kerberos TGS (Ticket-Granting Service) requests for suspicious patterns indicative of Kerberoasting, specifically looking for the use of weak encryption algorithms (RC4 or DES) and high volumes of service ticket requests for unique Service Principal Names (SPNs). It groups activity by source host and time window, flagging activity that involves DES encryption or a significant number of unique SPN requests. Great for detecting kerberoasting activity from unmanaged or rogue devices
PKINIT DC Impersonation from Non-DC Host
Cortex XDR
This rule detects potential Kerberos PKINIT (Pre-Authentication Type 16) authentication requests where a Domain Controller account (identified via User Account Control bit 8192) is targeted by an authentication attempt originating from a non-DC client address. This behavior may indicate an attempt to impersonate or misuse a high-privilege account for lateral movement or persistence.
Page 4 of 9