Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
3
2
Contributors
2
2
1
Categories
3
2
1
1
1
Platforms
5
Products / Services
2
1
1
1
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
'A service principal name (SPN) is used to uniquely identify a service instance in a Windows environment.
Each SPN is usually associated with a service account. Organizations may have used service accounts with weak passwords in their environment.
An attacker can try requesting Kerberos ticket-granting service (TGS) service tickets for any SPN from a domain controller (DC) which contains a hash of the Service account. This can then be used for offline cracking.
This hunting query looks for accounts that are generating excessive requests to different resources within the last hour compared with the previous 24 hours. Normal users would not make an unusually large number of request within a small time window. This is based on 4769 events which can be very noisy so environment based tweaking might be needed.'
Each SPN is usually associated with a service account. Organizations may have used service accounts with weak passwords in their environment.
An attacker can try requesting Kerberos ticket-granting service (TGS) service tickets for any SPN from a domain controller (DC) which contains a hash of the Service account. This can then be used for offline cracking.
This hunting query looks for accounts that are generating excessive requests to different resources within the last hour compared with the previous 24 hours. Normal users would not make an unusually large number of request within a small time window. This is based on 4769 events which can be very noisy so environment based tweaking might be needed.'
Roasting
KQL
Detect Active Directory LDAP queries that search for Kerberoasting (SPNs) or accounts with Kerberos preauthentication not required from Azure ATP, and try to get the process initiated the LDAP query from MDATP.
Replace 389 on line 5 with LDAP port in your environment
Replace true on line 6 to false if you want to include Nt Authority process
This LDAP query cover Rubeus, Kerberoast, BloodHound tools
Replace 389 on line 5 with LDAP port in your environment
Replace true on line 6 to false if you want to include Nt Authority process
This LDAP query cover Rubeus, Kerberoast, BloodHound tools
Detects service principal name (SPN) enumeration used for Kerberoasting
Detects service principal name (SPN) enumeration used for Kerberoasting
Detects service principal name (SPN) enumeration used for Kerberoasting
