Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
173 detections
Filters
Last updated
All Time
Detection languages
81
28
22
18
8
Contributors
67
51
14
12
6
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
168
9
2
Products / Services
150
137
129
5
4
MITRE Techniques
99
90
40
29
22
CVEs
3
2
1
1
IDS Classtypes
3
1
1
IDS Protocols
3
2
Detects Kerberos Authentication Service Requests (AS-REQ) where the pre-authentication type is set to 0. This is a characteristic indicator of legacy authentication or potentially malicious activity, such as Kerberoasting or brute-force attempts targeting the authentication service.
Detects Kerberos Authentication Service Requests (AS-REQ) where the pre-authentication type is set to 0. This is a characteristic indicator of legacy authentication or potentially malicious activity, such as Kerberoasting or brute-force attempts targeting the authentication service.
This rule detects potential Kerberos Golden Ticket attacks by identifying Kerberos authentication service (AS) request events (EventID 4768) where the ticket encryption type is 0x17 (RC4-HMAC) and the difference between the event generation time and the ticket's start time is greater than one day. This large time difference can indicate a forged ticket with an invalid timestamp, a common characteristic of Golden Tickets. The rule then summarizes these events by target username and computer, flagging instances where three or more such events occur.
This rule detects Kerberos Domain Trust Discovery attempts by monitoring for a high volume of Kerberos Ticket Granting Ticket (TGT) requests to port 88 (Kerberos) on the home network. A threshold of 20 requests from a single source IP within 10 seconds triggers the alert, indicating a potential network scan activity aimed at mapping domain trusts.
This rule detects potential Golden Ticket attacks by looking for multiple successful Kerberos authentication events (EventID 4624) with LogonType 3 (network logon) and a specific TicketEncryptionType (0x17), originating from the same IP address and targeting the same user, within a short timeframe and with a long ticket lifetime. A Golden Ticket attack involves an adversary forging Kerberos Ticket Granting Tickets (TGTs) to gain unauthorized access to resources.
This rule detects potential Kerberos Golden Ticket attacks by identifying Kerberos authentication service (AS) request events (EventID 4768) where the ticket encryption type is 0x17 (RC4-HMAC) and the difference between the event generation time and the ticket's start time is greater than one day. This large time difference can indicate a forged ticket with an invalid timestamp, a common characteristic of Golden Tickets. The rule then summarizes these events by target username and computer, flagging instances where three or more such events occur.
This rule detects and summarizes Kerberos authentication ticket requests (EventID 4765) and Kerberos authentication ticket request failures (EventID 4766) by subject username on an hourly basis. A high volume of these events for a single user could indicate credential stuffing, brute-force attempts, or other authentication-related anomalies.
This rule detects potential Kerberos Constrained Delegation attacks by monitoring Security Event ID 4769 (A Kerberos service ticket was requested) for tickets with the '0x80000000' option, which indicates a forwardable ticket. The rule then aggregates these events by target username, client address, and IP address, flagging instances where 8 or more such tickets are requested, which could indicate an attempt to abuse constrained delegation.
This rule detects potential Golden Ticket attacks by looking for multiple successful Kerberos authentication events (EventID 4624) with LogonType 3 (network logon) and a specific TicketEncryptionType (0x17), originating from the same IP address and targeting the same user, within a short timeframe and with a long ticket lifetime. A Golden Ticket attack involves an adversary forging Kerberos Ticket Granting Tickets (TGTs) to gain unauthorized access to resources.
Detects Kerberoasting attack via high-volume Kerberos TGS requests
This rule detects potential Kerberoasting attacks by identifying a high number of Kerberos Ticket-Granting Service (TGS) requests (EventID 4769) for Service Principal Names (SPNs) that are encrypted with RC4 (indicated by TicketOptions containing '0x40810000'). A threshold of 15 or more TGS requests from a single IP address for a target user is used to flag suspicious activity.
This rule detects Kerberos Pass-the-Ticket attacks where a Ticket Granting Service (TGS) request contains a forged Privilege Attribute Certificate (PAC). This is identified by specific byte sequences in UDP traffic on port 88, which is commonly used for Kerberos.
This rule detects and summarizes Kerberos authentication ticket requests (EventID 4765) and Kerberos authentication ticket request failures (EventID 4766) by subject username on an hourly basis. A high volume of these events for a single user could indicate credential stuffing, brute-force attempts, or other authentication-related anomalies.
This rule detects potential Kerberoasting attacks by identifying a high number of Kerberos Ticket-Granting Service (TGS) requests (EventID 4769) for Service Principal Names (SPNs) that are encrypted with RC4 (indicated by TicketOptions containing '0x40810000'). A threshold of 15 or more TGS requests from a single IP address for a target user is used to flag suspicious activity.
This rule detects unauthorized Kerberos service ticket requests directed at a Domain Controller (DC). It specifically looks for TCP traffic to port 88 (Kerberos) on the home network, with a content match for the byte sequence '|6b|' at the beginning of the payload. A threshold of 50 requests within 10 seconds from the same source IP triggers the alert, indicating a potential brute-force or enumeration attempt against Kerberos services.
This rule detects potential Kerberos Constrained Delegation attacks by monitoring Security Event ID 4769 (A Kerberos service ticket was requested) for tickets with the '0x80000000' option, which indicates a forwardable ticket. The rule then aggregates these events by target username, client address, and IP address, flagging instances where 8 or more such tickets are requested, which could indicate an attempt to abuse constrained delegation.
This rule detects an anomaly in Kerberos Ticket Granting Ticket (TGT) requests. Specifically, it triggers an alert if more than 50 UDP Kerberos TGT requests are observed from a single source IP address within a 10-second window to the home network on port 88. This behavior could indicate an attempt to enumerate valid user accounts or perform credential stuffing/brute-force attacks against the Kerberos authentication system, potentially as part of a privilege escalation attempt (ATT&CK T1134).
This rule detects potential Kerberoasting activity by identifying an unusual number of Kerberos service ticket requests (Event ID 4769) for service principal names (SPNs) ending with '$' from a single client address within an hour. A high count (over 10) is flagged as 'High' suspicion, while a count between 5 and 10 is flagged as 'Medium'. This behavior is indicative of an attacker attempting to obtain service ticket hashes for offline cracking.
Detects Kerberos service ticket requests (TGS) for canary Service Principal Names (SPNs). Any request for a ticket to a canary SPN is highly indicative of a Kerberoasting attack (T1558.003) or other reconnaissance activity, as these accounts have no legitimate purpose. Creation of Canary SPNs can be found here: https://github.com/fluffybunnies-h4x/CyberDeception?tab=readme-ov-file#creating-a-canary-spn-account
Detects the execution of the hacktool Rubeus using specific command line flags within PowerShell script block logs. This rule identifies various Kerberos-related attacks such as AS-REPRoasting, Kerberoasting, Pass-the-Ticket, Golden Ticket, and Silver Ticket attacks, as well as credential harvesting and dumping.
This rule will collect the data needed to start looking into possible kerberoasting activity.
Further analysis or computation within the query is needed focusing on requests from one specific host/IP towards multiple service names within a time period of 5 seconds.
You can then set a threshold for the number of requests and time between the requests to turn this into an alert.
Further analysis or computation within the query is needed focusing on requests from one specific host/IP towards multiple service names within a time period of 5 seconds.
You can then set a threshold for the number of requests and time between the requests to turn this into an alert.
Page 7 of 9