| elastic |
User account exposed to Kerberoasting |
production |
2026-10-06 |
| elastic |
First Time Python Accessed Sensitive Credential Files |
production |
2026-09-29 |
| splunk |
Windows Kerberos Local Successful Logon |
production |
2026-09-22 |
| splunk |
Windows Domain Admin Impersonation Indicator |
production |
2026-09-22 |
| elastic |
Newly Observed RC4 Kerberos Service Ticket Request |
production |
2026-09-18 |
| elastic |
Kerberos Traffic from Unusual Process |
production |
2026-09-18 |
| elastic |
Kirbi File Creation |
production |
2026-09-18 |
| elastic |
Potential Invoke-Mimikatz PowerShell Script |
production |
2026-09-18 |
| elastic |
PKINIT Followed by Same-Principal U2U Service Ticket |
production |
2026-09-18 |
| elastic |
PowerShell Kerberos Ticket Dump |
production |
2026-09-18 |
| elastic |
PowerShell Kerberos Ticket Request |
production |
2026-09-18 |
| elastic |
Sensitive Privilege SeEnableDelegationPrivilege assigned to a Principal |
production |
2026-09-18 |
| elastic |
Potential PowerShell HackTool Script by Function Names |
production |
2026-09-18 |
| elastic |
Suspicious Kerberos Authentication Ticket Request |
production |
2026-09-18 |
| elastic |
KRBTGT Delegation Backdoor |
production |
2026-09-18 |
| elastic |
Service Creation via Local Kerberos Authentication |
production |
2026-09-18 |
| elastic |
Kerberos Cached Credentials Dumping |
production |
2026-09-18 |
| elastic |
Potential Kerberos Attack via Bifrost |
production |
2026-09-18 |
| elastic |
Kerberos Pre-authentication Disabled for User |
production |
2026-09-18 |
| sigma |
Antivirus - Password Dumper Signature |
stable |
2026-06-15 |
| splunk |
Windows Computer Account Created by Computer Account |
production |
2026-05-13 |
| splunk |
Windows Computer Account Requesting Kerberos Ticket |
production |
2026-05-13 |
| splunk |
Windows Computer Account With SPN |
production |
2026-05-13 |
| splunk |
Windows Steal or Forge Kerberos Tickets Klist |
production |
2026-05-13 |
| sigma |
Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock |
experimental |
2025-03-05 |
| sigma |
HackTool - Mimikatz Kirbi File Creation |
test |
2024-06-27 |
| sigma |
Uncommon Outbound Kerberos Connection |
test |
2024-03-15 |
| sigma |
Replay Attack Detected |
test |
2022-10-14 |
| elastic |
Potential Privilege Escalation via Local Kerberos Relay over LDAP |
deprecated |
2022-08-01 |
| sentinel |
Potential Kerberoasting |
Scheduled |
— |