Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
173 detections
Filters
Last updated
All Time
Detection languages
81
28
22
18
8
Contributors
67
51
14
12
6
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
168
9
2
Products / Services
150
137
129
5
4
MITRE Techniques
99
90
40
29
22
CVEs
3
2
1
1
IDS Classtypes
3
1
1
IDS Protocols
3
2
This rule detects potential Kerberoasting activity by monitoring for high volumes of Kerberos TGS (Ticket Granting Service) requests (Event ID 4769) using the RC4 encryption type (0x17) within a short timeframe. Kerberoasting involves requesting tickets for service accounts to offline crack their passwords. The rule filters out known service accounts and system-level accounts ending in '$'.
Detects Kerberoasting attempts by identifying suspicious Ticket Granting Service (TGS) requests (Event ID 4769) for the 'krbtgt' service or other services where the ticket encryption type is RC4 (0x17) or older/weaker encryption types (0x18), especially when these requests are not preceded by a corresponding Ticket Granting Ticket (TGT) request (Event ID 4768).
Detects Kerberos Ticket Granting Service (TGS) requests using RC4 encryption (etype 0x17) by non-service accounts, which is a common indicator of a Kerberoasting attack where adversaries attempt to crack service account passwords offline.
Detects an abnormally high volume of Kerberos TGS (Ticket Granting Service) requests encrypted with RC4 (0x17) from a single source IP. This behavior is indicative of Kerberoasting, an attack where an adversary attempts to extract service account passwords from requested TGS tickets.
This rule detects potential Kerberos Golden Ticket attacks by identifying Kerberos authentication service (AS) request events (EventID 4768) where the ticket encryption type is 0x17 (RC4-HMAC) and the difference between the event generation time and the ticket's start time is greater than one day. This large time difference can indicate a forged ticket with an invalid timestamp, a common characteristic of Golden Tickets. The rule then summarizes these events by target username and computer, flagging instances where three or more such events occur.
This rule detects potential AS-REP Roasting attacks by monitoring for Kerberos TGT requests (Event ID 4768) where Kerberos pre-authentication is disabled (PreAuthType == 0) and the ticket encryption type uses weak algorithms (RC4-HMAC or AES128). This behavior allows an attacker to request a ticket for an account and perform offline password cracking.
Detects Kerberos Ticket Granting Service (TGS) requests using RC4 encryption (etype 0x17) by non-service accounts, which is a common indicator of a Kerberoasting attack where adversaries attempt to crack service account passwords offline.
This rule detects potential AS-REP Roasting activity by monitoring for a single source IP address requesting Kerberos TGTs (Event ID 4768) for multiple distinct user accounts within a 10-minute window. This behavior often indicates an attacker attempting to identify and harvest Kerberos pre-authentication hashes from accounts that do not require pre-authentication, which can then be cracked offline.
Detects Kerberos service ticket requests (TGS) where the encryption type is set to 0x17 (RC4-HMAC). This is commonly used in Kerberoasting attacks to capture service ticket hashes for offline brute-force attacks.
Detects Kerberos Ticket Granting Service (TGS) requests using RC4 encryption (0x17), which is a common indicator of Kerberoasting. The rule excludes common non-user account ticket requests (machine accounts and krbtgt) to reduce noise, focusing on potential service account targeting.
Detects Kerberos Ticket Granting Service (TGS) requests using RC4 encryption (0x17), which is a common indicator of Kerberoasting. The rule excludes common non-user account ticket requests (machine accounts and krbtgt) to reduce noise, focusing on potential service account targeting.
Detects Kerberos Authentication Service Requests (AS-REQ) resulting in a ticket granting ticket (TGT) where the TicketOptions field is set to '0x40810010'. This specific combination is often associated with the behavior of tools performing Kerberoasting or specific types of ticket-based attacks, as it indicates a TGT request that may bypass standard pre-authentication or follow non-standard flow patterns.
Detects Kerberos Authentication Service Requests (AS-REQ) resulting in a ticket granting ticket (TGT) where the TicketOptions field is set to '0x40810010'. This specific combination is often associated with the behavior of tools performing Kerberoasting or specific types of ticket-based attacks, as it indicates a TGT request that may bypass standard pre-authentication or follow non-standard flow patterns.
Detects Kerberos AS-REQ events (Event ID 4768) where pre-authentication is not used (PreAuthType 0). This is a common indicator of attempts to perform Kerberoasting or AS-REP roasting, as attackers may attempt to request tickets for accounts without requiring the initial pre-authentication step.
This rule detects potential Kerberoasting activity by monitoring Windows Event ID 4769 (Kerberos service ticket request). It identifies excessive requests for service tickets using RC4 encryption (0x17) by a single account within a 10-minute window, excluding common service accounts and krbtgt requests.
Detects Kerberos AS-REQ (Event 4768) using certificate-based pre-authentication (PKINIT / PA-PK-AS-REQ) with AES256 encryption. This represents the second stage of a Shadow Credentials attack, where an adversary authenticates using a rogue key credential they previously wrote to msDS-KeyCredentialLink. The rule filters out legitimate PKI-issued certificates from specified CAs and computer accounts.
This rule detects potential AS-REP Roasting attacks by monitoring for Kerberos TGT requests (Event ID 4768) where Kerberos pre-authentication is disabled (PreAuthType == 0) and the ticket encryption type uses weak algorithms (RC4-HMAC or AES128). This behavior allows an attacker to request a ticket for an account and perform offline password cracking.
This rule detects potential AS-REP Roasting attacks by monitoring for Kerberos TGT requests (Event ID 4768) where Kerberos pre-authentication is disabled (PreAuthType == 0) and the ticket encryption type uses weak algorithms (RC4-HMAC or AES128). This behavior allows an attacker to request a ticket for an account and perform offline password cracking.
This rule detects potential Kerberoasting activity by monitoring for high volumes of Kerberos TGS (Ticket Granting Service) requests (Event ID 4769) using the RC4 encryption type (0x17) within a short timeframe. Kerberoasting involves requesting tickets for service accounts to offline crack their passwords. The rule filters out known service accounts and system-level accounts ending in '$'.
Detects Kerberos service ticket requests (TGS) where the encryption type is set to 0x17 (RC4-HMAC). This is commonly used in Kerberoasting attacks to capture service ticket hashes for offline brute-force attacks.
Detects Kerberos AS-REQ events (Event ID 4768) where pre-authentication is not used (PreAuthType 0). This is a common indicator of attempts to perform Kerberoasting or AS-REP roasting, as attackers may attempt to request tickets for accounts without requiring the initial pre-authentication step.
Page 6 of 9