Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
58 detections
Filters
Last updated
All Time
Detection languages
29
7
6
5
5
Contributors
14
10
7
7
6
Categories
48
22
17
11
7
Platforms
55
1
1
Products / Services
31
30
23
12
7
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
IDS Classtypes
1
IDS Protocols
2
1
This rule detects potential AS-REP Roasting attempts by identifying an unusually high volume of Kerberos AS-REQ requests (Event ID 4768) where the preauthentication type is set to 0. These requests are grouped by source IP or client address, and alerts are triggered when the number of unique accounts targeted or the total request count exceeds defined thresholds. AS-REP Roasting is an attack technique that attempts to retrieve a TGT for user accounts that have Kerberos preauthentication disabled, making them susceptible to offline brute-force password cracking.
This rule detects potential AS-REP Roasting attempts by identifying an unusually high volume of Kerberos AS-REQ requests (Event ID 4768) where the preauthentication type is set to 0. These requests are grouped by source IP or client address, and alerts are triggered when the number of unique accounts targeted or the total request count exceeds defined thresholds. AS-REP Roasting is an attack technique that attempts to retrieve a TGT for user accounts that have Kerberos preauthentication disabled, making them susceptible to offline brute-force password cracking.
Detects the execution of Rubeus, a common security tool used for Kerberos-based attacks including Golden/Silver Ticket forgery, AS-REP roasting, Kerberoasting, and ticket harvesting. The rule monitors command-line indicators associated with known Rubeus arguments.
This rule detects potential AS-REP Roasting activity by monitoring Windows Event ID 4768 (TGT Request). It identifies multiple Kerberos AS-REQ requests from a single IP address within a 10-minute window, where the PreAuthType is 0 (indicating no pre-authentication) and the encryption type is RC4 (0x17 or 23). This behavior is characteristic of enumeration and exploitation tools such as Rubeus or Impacket's GetNPUsers.py, which attempt to obtain extractable TGTs for accounts that do not require Kerberos pre-authentication.
Detects multiple Kerberos AS-REQ (Event ID 4768) requests initiated for distinct user accounts from a single source IP within a short timeframe (10 minutes) where Kerberos pre-authentication was not used (Pre-Authentication Type 0). This pattern is a key indicator of AS-REP roasting activity, often performed by tools like Rubeus or Impacket's GetNPUsers.py to harvest user TGTs for offline cracking.
Detects the execution of the Rubeus toolset with command-line arguments indicative of Kerberos ticket abuse, including Kerberoasting, AS-REP Roasting, and Pass-the-Ticket (PTT) techniques. These methods are commonly used by adversaries for credential harvesting and facilitating lateral movement within an Active Directory environment.
Detects the execution of the Rubeus.exe utility with command-line arguments indicative of Kerberos-related credential harvesting and abuse, such as Kerberoasting, AS-REP Roasting, and Pass-the-Ticket attacks.
Detects Kerberos TGT or TGS requests that either exhibit a suspicious combination of ticket flags (Forwardable + Proxiable + Renewable) when associated with high-value targets, unusual accounts, or off-hours activity, or utilize the weak RC4-HMAC encryption type, both of which are indicative of ticket manipulation and credential theft.
Detects the execution of the Rubeus.exe utility with command-line arguments indicative of Kerberos-related credential harvesting and abuse, such as Kerberoasting, AS-REP Roasting, and Pass-the-Ticket attacks.
Detects Kerberos TGT or TGS requests that either exhibit a suspicious combination of ticket flags (Forwardable + Proxiable + Renewable) when associated with high-value targets, unusual accounts, or off-hours activity, or utilize the weak RC4-HMAC encryption type, both of which are indicative of ticket manipulation and credential theft.
Detects Kerberos TGT or TGS requests that either exhibit a suspicious combination of ticket flags (Forwardable + Proxiable + Renewable) when associated with high-value targets, unusual accounts, or off-hours activity, or utilize the weak RC4-HMAC encryption type, both of which are indicative of ticket manipulation and credential theft.
Detects Kerberos TGT or TGS requests that either exhibit a suspicious combination of ticket flags (Forwardable + Proxiable + Renewable) when associated with high-value targets, unusual accounts, or off-hours activity, or utilize the weak RC4-HMAC encryption type, both of which are indicative of ticket manipulation and credential theft.
Detects Kerberos TGT or TGS requests that either exhibit a suspicious combination of ticket flags (Forwardable + Proxiable + Renewable) when associated with high-value targets, unusual accounts, or off-hours activity, or utilize the weak RC4-HMAC encryption type, both of which are indicative of ticket manipulation and credential theft.
Detects the execution of the Rubeus.exe utility with command-line arguments indicative of Kerberos-related credential harvesting and abuse, such as Kerberoasting, AS-REP Roasting, and Pass-the-Ticket attacks.
Detects the execution of the Rubeus.exe utility with command-line arguments indicative of Kerberos-related credential harvesting and abuse, such as Kerberoasting, AS-REP Roasting, and Pass-the-Ticket attacks.
Detects the execution of the Rubeus.exe utility with command-line arguments indicative of Kerberos-related credential harvesting and abuse, such as Kerberoasting, AS-REP Roasting, and Pass-the-Ticket attacks.
AS-REP Roasting Potential Enumeration
Cortex XDR
Detects Kerberos AS-REQ events (Event ID 4768) where accounts with Kerberos pre-authentication disabled successfully request an AS-REP ticket. Attackers exploit these accounts by requesting encrypted AS-REP blobs to perform offline password cracking. The rule flags potential enumeration when multiple unique accounts are targeted from the same source within a short timeframe.
Shows all Kerberos authentication activity on domain controllers - TGT requests, TGS requests, and pre-auth failures (4768/4769/4771). Good for hunting credential attacks, AS-REP roasting, weak encryption usage, and account lockout troubleshooting.
This detection identifies a single source IP performing high-volume Kerberos AS-REQ authentication attempts against multiple user accounts (>5 unique accounts, >20 total requests), indicating enumeration or brute-force credential access. Attackers use AS-REQ enumeration to discover valid accounts and test credentials before lateral movement or privilege escalation. This pattern is characteristic of 2025 ransomware and APT campaigns targeting Active Directory environments.
I generated the telemetry utilizing atomic red team, pc + VM DC
I generated the telemetry utilizing atomic red team, pc + VM DC
Detects privileged Active Directory enumeration seen on the wire by Corelight, filtered to source hosts that don't appear in the Cortex endpoint inventory. It reads ldap_search records from corelight_zeek_raw, tiers them by the LDAP filter (CRITICAL for credential-attribute and DCSync hunting, HIGH for Tier Zero, Kerberoast, delegation, and UAC-bitmask targeting, MEDIUM for broad group, computer, and GPO enumeration), then joins the source address against endpoints and keeps only the queries whose id_orig_h has no matching managed agent
Detects privileged Active Directory enumeration seen on the wire by Corelight, filtered to source hosts that don't appear in the Cortex endpoint inventory. It reads ldap_search records from corelight_zeek_raw, tiers them by the LDAP filter (CRITICAL for credential-attribute and DCSync hunting, HIGH for Tier Zero, Kerberoast, delegation, and UAC-bitmask targeting, MEDIUM for broad group, computer, and GPO enumeration), then joins the source address against endpoints and keeps only the queries whose id_orig_h has no matching managed agent
Page 1 of 3