Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
114 detections
Filters
Last updated
All Time
Detection languages
45
44
14
5
3
Contributors
24
23
14
10
9
Categories
76
40
15
13
12
Platforms
106
3
2
1
1
Products / Services
65
49
43
11
5
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
4
2
2
1
1
IDS Classtypes
1
IDS Protocols
1
Detects anomalous Kerberos ticket requests observed by ADAudit Plus. Service ticket
harvesting — one account requesting tickets for many services in quick succession —
is the precursor to offline cracking of service account credentials, and it is quiet
at the domain controller unless something is watching for the pattern.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=win-audit where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='KERBEROS_AUTHENTICATION_TICKET_REQUESTED'
| duration 1h
| groupby user, domain
| select user, domain, count(*) as cnt
| having cnt > 20
harvesting — one account requesting tickets for many services in quick succession —
is the precursor to offline cracking of service account credentials, and it is quiet
at the domain controller unless something is watching for the pattern.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=win-audit where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='KERBEROS_AUTHENTICATION_TICKET_REQUESTED'
| duration 1h
| groupby user, domain
| select user, domain, count(*) as cnt
| having cnt > 20
Detects Kerberos service ticket requests observed in network traffic analysis.
Seeing this on the wire rather than at the domain controller catches harvesting even
where domain controller auditing is incomplete, and it gives the source address
directly rather than requiring correlation.
Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=nta-connection where sourcename='NTA'
and action='KERBEROS_SERVICE_TICKET_REQUESTED'
| duration 1h
| groupby srcip, dstip
| select srcip, dstip, count(*) as cnt
| having cnt > 20
Seeing this on the wire rather than at the domain controller catches harvesting even
where domain controller auditing is incomplete, and it gives the source address
directly rather than requiring correlation.
Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=nta-connection where sourcename='NTA'
and action='KERBEROS_SERVICE_TICKET_REQUESTED'
| duration 1h
| groupby srcip, dstip
| select srcip, dstip, count(*) as cnt
| having cnt > 20
A SPNEGO authentication token was replayed against an SAP system
The following analytic identifies a local successful authentication event on a Windows endpoint using the Kerberos package.
It detects EventCode 4624 with LogonType 3 and source address 127.0.0.1, indicating a login to the built-in local Administrator account.
This activity is significant as it may suggest a Kerberos relay attack, a method attackers use to escalate privileges.
If confirmed malicious, this could allow an attacker to gain unauthorized access to sensitive systems, execute arbitrary code, or create new accounts in Active Directory, leading to potential system compromise.
It detects EventCode 4624 with LogonType 3 and source address 127.0.0.1, indicating a login to the built-in local Administrator account.
This activity is significant as it may suggest a Kerberos relay attack, a method attackers use to escalate privileges.
If confirmed malicious, this could allow an attacker to gain unauthorized access to sensitive systems, execute arbitrary code, or create new accounts in Active Directory, leading to potential system compromise.
The following analytic identifies potential Kerberos ticket forging attacks, specifically the Diamond Ticket attack. This is detected when a user logs into a host and the GroupMembership field in event 4627 indicates a privileged group (e.g., Domain Admins), but the user does not actually belong to that group in the directory service. The detection leverages Windows Security Event Log 4627, which logs account logon events. The analytic cross-references the GroupMembership field from the event against a pre-populated lookup of actual group memberships. Its crucial to note that the accuracy and effectiveness of this detection heavily rely on the users diligence in populating and regularly updating this lookup table. Any discrepancies between the events GroupMembership and the lookup indicate potential ticket forging. Kerberos ticket forging, especially the Diamond Ticket attack, allows attackers to impersonate any user and potentially gain unauthorized access to resources. By forging a ticket that indicates membership in a privileged group, an attacker can bypass security controls and gain elevated privileges. Detecting such discrepancies in group memberships during logon events can be a strong indicator of this attack in progress, making it crucial for security teams to monitor and investigate. If validated as a true positive, this indicates that an attacker has successfully forged a Kerberos ticket and may have gained unauthorized access to critical resources, potentially with elevated privileges.
Detects the use of Mimikatz-style command-line arguments to manipulate Kerberos tickets, including ticket requests, purges, and golden/silver ticket creation attempts.
Detects suspicious post-compromise activity associated with ALPHV/BlackCat affiliates. This rule monitors for anomalous Kerberos ticket requests (e.g., weak encryption types or TGS requests) closely followed by access to sensitive credential stores or tools on the same host, which is indicative of credential harvesting after a session hijacking or initial access event.
Detects the execution of Rubeus, a common security tool used for Kerberos-based attacks including Golden/Silver Ticket forgery, AS-REP roasting, Kerberoasting, and ticket harvesting. The rule monitors command-line indicators associated with known Rubeus arguments.
If your environment does not normally use smart cards or certificate-based authentication, or if a user who does not typically authenticate using smart cards suddenly generates events with TokenHasThisOrgCertificateSid, this may warrant investigation, as it could indicate authentication using a fraudulently issued certificate.
Detects the execution of the Rubeus tool, a widely used offensive security tool for Kerberos manipulation, including ticket requests, pass-the-ticket, and credential dumping.
Detects Kerberos Ticket Granting Service (TGS) requests (Event ID 4769) that use RC4 encryption (0x17). In modern Active Directory environments, RC4 is considered weak and is often explicitly requested by attackers during Kerberoasting to facilitate offline brute-force cracking of service account passwords. The rule excludes common service accounts (e.g., krbtgt, machine accounts) to reduce noise.
AS-REP Roasting Potential Enumeration
Cortex XDR
Detects Kerberos AS-REQ events (Event ID 4768) where accounts with Kerberos pre-authentication disabled successfully request an AS-REP ticket. Attackers exploit these accounts by requesting encrypted AS-REP blobs to perform offline password cracking. The rule flags potential enumeration when multiple unique accounts are targeted from the same source within a short timeframe.
Detects the addition of a 'msDS-KeyCredentialLink' attribute to an Active Directory object (Event 5136), which is indicative of the Shadow Credentials attack vector, followed by a successful PKINIT authentication (Event 4768) for that account. This combination suggests that an adversary has successfully established persistent access using a forged or unauthorized device credential and is now utilizing it for authentication.
Detects successful Kerberos PKINIT authentication (Event 4768, PreAuthType 16) issued by on-premises certificate authorities. This activity is a potential indicator of Shadow Credentials or Active Directory Certificate Services (AD CS) abuse where attackers use forged or stolen certificates to authenticate as domain users or machines.
Detects the use of the "Get-ADComputer" cmdlet in order to identify systems which are configured for unconstrained delegation.
This Defender XDR query detects high-confidence attempts to export certificates with private keys using native Windows utilities, PowerShell, Mimikatz, AADInternals, Certipy, OpenSSL, and certificate-management tools.
Detects Defender XDR alerts and evidence potentially related to Certighost / CVE-2026-54121 AD CS abuse, including suspicious certificate requests, Kerberos activity, LDAP security principal anomalies, and possible DCSync or directory replication abuse.
This rule detects Kerberos Service Ticket (TGS) requests made for the 'AZUREADSSOACC$' computer account, which is typically used for Seamless Single Sign-On (SSO) in hybrid Azure AD environments. The rule explicitly excludes known Domain Controllers from triggering the alert to focus on potentially suspicious TGS requests originating from other systems.
This rule detects Kerberos Service Ticket (TGS) requests made for the 'AZUREADSSOACC$' computer account, which is typically used for Seamless Single Sign-On (SSO) in hybrid Azure AD environments. The rule explicitly excludes known Domain Controllers from triggering the alert to focus on potentially suspicious TGS requests originating from other systems.
Detects anomalous certificate issuance via Active Directory Certificate Services (AD CS) where a machine-template certificate is issued to a non-computer requester, but the issued certificate's Subject Alternative Name contains a dNSHostName identifier associated with a Domain Controller. This pattern matches the exploitation of the 'CertiGhost' vulnerability (CVE-2026-54121), which allows unauthorized entities to obtain certificates masquerading as Domain Controllers for potential Kerberos authentication abuse.
Detects a single unrecognized process combining two or more distinct PRO/ULTIMATE surveillance behaviors: webcam capture via Win32 Media Foundation, screenshot/screen-recorder file drops, and keystroke/clipboard dump file creation, within a short 15-minute window. Excludes known legitimate screen-recording, remote-support, and accessibility software.
Page 1 of 6