Skip to content
Threat Feed
Subscribe

Tag

Kerberoasting

4 briefs RSS
high advisory

Windows AD ServicePrincipalName Added To Domain Account

This Splunk analytic detects the addition of a Service Principal Name (SPN) to a domain account by monitoring Windows Event Code 5136 and changes to the servicePrincipalName attribute, potentially indicating Kerberoasting attempts leading to unauthorized access.

Splunk Enterprise +2 kerberoasting active_directory spn persistence
2r 1t
high advisory

PowerShell Kerberos Ticket Request via KerberosRequestorSecurityToken

This rule detects PowerShell scripts that request Kerberos service tickets using KerberosRequestorSecurityToken, potentially indicating Kerberoasting attacks for offline password cracking of service accounts.

Elastic Security kerberoasting credential_access windows
2r 1t
medium threat

Kerberos Traffic from Unusual Process

Detects network connections to the standard Kerberos port from an unusual process other than lsass.exe, potentially indicating Kerberoasting or Pass-the-Ticket activity on Windows systems.

Elastic Defend +22 kerberoasting credential-access lateral-movement windows
2r 2t
medium advisory

User Account ServicePrincipalName Attribute Modified

Detection of modifications to the servicePrincipalName attribute on user accounts, potentially exposing them to Kerberoasting attacks by allowing attackers to request Kerberos tickets for the account.

Active Directory kerberoasting credential-access windows spn
2r 2t