Kerberoasting Activity - Initial Query
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
This rule will collect the data needed to start looking into possible kerberoasting activity. Further analysis or computation within the query is needed focusing on requests from one specific host/IP towards multiple service names within a time period of 5 seconds. You can then set a threshold for the number of requests and time between the requests to turn this into an alert.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Kerberos Activity" AND (ERRORCODE = "0x0" AND ENCRYPTIONTYPE = "0x17") AND (SERVICENAME notendswith "krbtgt,$" OR USERNAME notcontains "$@") select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.DOMAIN,Action1.SERVICENAME,Action1.REMOTEHOST,Action1.ERRORCODE
Detection
Execution Mode
realtime
Log Sources
Active Directory
Author
@kostastsale
