Blu Raven Academy
@BluRaven3 followers4 downloads8 copies3 likes421 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
Platforms
1
Products / Services
1
1
MITRE Techniques
1
This rule detects suspicious service account (SPN enabled) logon attempts originating from workstation subnets. This activity can be an indicator of credential dumping techniques. The rule looks for Event ID 4768 (A Kerberos authentication ticket (TGT) was requested) where the target user name is a known SPN-enabled account and the source IP address falls within defined workstation subnets.
