IGEL

CVE-2026-82017 allows attackers with physical access to inject arbitrary kernel command-line parameters into IGEL OS boot configurations, resulting in privilege escalation while bypassing TPM measurements.

This rule detects suspicious Kerberos authentication ticket requests by correlating network connections to the standard Kerberos port (88) from a source machine with a Kerberos authentication ticket request from the target domain controller, which could indicate lateral movement or credential access attempts within a Windows domain.