Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
114 detections
Filters
Last updated
All Time
Detection languages
45
44
14
5
3
Contributors
24
23
14
10
9
Categories
76
40
15
13
12
Platforms
106
3
2
1
1
Products / Services
65
49
43
11
5
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
4
2
2
1
1
IDS Classtypes
1
IDS Protocols
1
Detects the presence of a base64-encoded signature ("UWhRC....AAYBAAAA") in the command line, which corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. This pattern is a strong indicator of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests, potentially exploiting vulnerabilities like CVE-2025-33073. The rule aims to identify attempts to add spoofed SPNs to DNS records or check for their presence using commands like `nslookup`.
Detects DNS queries containing specific base64-encoded patterns ("UWhRCA" and "BAAAA") that are indicative of Kerberos coercion attacks via DNS object spoofing. This technique involves manipulating DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests, forcing victim systems to authenticate to attacker-controlled hosts. This is a strong indicator of a Kerberos coercion attack, potentially related to vulnerabilities like CVE-2025-33073, where a marshaled CREDENTIAL_TARGET_INFORMATION structure is used.
Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID). This could be a sign of exploitation of elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping. Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing.
Detects errors when a target server doesn't have suitable keys for generating Kerberos tickets. This issue can occur, for example, when a service uses a user account or a computer account that is configured for only DES encryption on a computer that is running Windows 7 which has DES encryption for Kerberos authentication disabled. This can indicate a misconfiguration or an attempt by an attacker to exploit weak encryption types.
Detects scenarios where an attacker request a potential Golden ticket. Findings returned by this rule may not confirm at 100% that a Golden ticket was generated and further investigations would be required to confirm it. Another indicator (in case of a lazy Golden ticket) to check would be to check if the TargetUserName refers to an existing user in the domain.
Detects scenarios where an attacker used a forged Golden ticket to login on a remote host. Per default or if specified, the ticket will be forged using the builtin administrator account (SID *-500). However, and it frequent cases, a non suspicious user name will be specificied during the forge in order to evade security monitoring. The rule works based on this trick.
Detects scenarios where an attacker abuse an account with UAC settings set to "Accounts Does not Require Pre-Authentication" in order to perform offline TGT brutforce. May also be triggered by an attacker performing some Kerberos user enumration with tools like "Kerbrute".
Detects scenarios where an attacker attempts to request a proxiable ticket. This action may trigger while attempting to identify a vulnerable target or using some offsensive Kerberos tools like Kerbrute, Impacket...
Detects scenarios where an attacker abuse Kerberos unconstrained delegation for domain persistence.
Detects scenarios where an attacker used a forged Golden ticket to login on a remote shared folder. Per default or if specified, the ticket will be forged using the builtin administrator account (SID *-500). However, and it frequent cases, a non suspicious user name will be specificied during the forge in order to evade security monitoring. The rule works based on this trick.
Detects scenarios where an attacker abuse Kerberos constrained delegation in order to escalate privileges.
Detects scenarios where an attacker attempts to spoof the SAM account name of a a domain controller in order to impersonate it. Vulnerability comes from that computer accounts should have a trailing $ in their name (i.e. sAMAccountName attribute) but no validation process existed until the patch was released. During the offensive phase, attacker will create and rename the sAMAccountName of a computer account to look like the one of a domain controller.
Detects scenarios where an attacker attempts to forge a special Kerberos service ticket in order to extract credentials from Read Only Domain Controllers (RODC).
KQL Query from file: Kerberos Roasting Detection
'A service principal name (SPN) is used to uniquely identify a service instance in a Windows environment.
Each SPN is usually associated with a service account. Organizations may have used service accounts with weak passwords in their environment.
An attacker can try requesting Kerberos ticket-granting service (TGS) service tickets for any SPN from a domain controller (DC) which contains a hash of the Service account. This can then be used for offline cracking.
This hunting query looks for accounts that are generating excessive requests to different resources within the last hour compared with the previous 24 hours. Normal users would not make an unusually large number of request within a small time window. This is based on 4769 events which can be very noisy so environment based tweaking might be needed.'
Each SPN is usually associated with a service account. Organizations may have used service accounts with weak passwords in their environment.
An attacker can try requesting Kerberos ticket-granting service (TGS) service tickets for any SPN from a domain controller (DC) which contains a hash of the Service account. This can then be used for offline cracking.
This hunting query looks for accounts that are generating excessive requests to different resources within the last hour compared with the previous 24 hours. Normal users would not make an unusually large number of request within a small time window. This is based on 4769 events which can be very noisy so environment based tweaking might be needed.'
Detects logon with "Special groups" and "Special Privileges" can be thought of as Administrator groups or privileges.
Detects the use of the "Get-ADComputer" cmdlet in order to identify systems which are configured for unconstrained delegation.
This query aim to detect if someone requests service tickets (where count => maxcount)
The query requires trimming to set a baseline level for MaxCount
Mitre Technique: Kerberoasting (T1558.003)
@MattiasBorg82
The query requires trimming to set a baseline level for MaxCount
Mitre Technique: Kerberoasting (T1558.003)
@MattiasBorg82
Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.
Detects a highly relevant Antivirus alert that reports a password dumper.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc.
Page 4 of 6