| sigma |
HackTool - GoldenDMSA Execution |
experimental |
2026-10-19 |
| splunk |
ServicePrincipalNames Discovery with SetSPN |
production |
2026-10-09 |
| elastic |
User account exposed to Kerberoasting |
production |
2026-10-06 |
| splunk |
Windows PowerView Kerberos Service Ticket Request |
production |
2026-10-02 |
| splunk |
Kerberoasting spn request with RC4 encryption |
production |
2026-10-02 |
| splunk |
Windows AD Computer SPN Modified By User Account |
production |
2026-09-25 |
| elastic |
Potential Kerberos Attack via Bifrost |
production |
2026-09-18 |
| elastic |
Kerberos Cached Credentials Dumping |
production |
2026-09-18 |
| elastic |
Newly Observed RC4 Kerberos Service Ticket Request |
production |
2026-09-18 |
| elastic |
Kerberos Traffic from Unusual Process |
production |
2026-09-18 |
| elastic |
Suspicious Kerberos Authentication Ticket Request |
production |
2026-09-18 |
| elastic |
Potential PowerShell HackTool Script by Function Names |
production |
2026-09-18 |
| elastic |
PowerShell Kerberos Ticket Request |
production |
2026-09-18 |
| sigma |
Suspicious Kerberos Ticket Request via PowerShell Script - ScriptBlock |
test |
2026-09-14 |
| sigma |
Suspicious Kerberos Ticket Request via CLI |
experimental |
2026-09-14 |
| splunk |
Unusual Number of Kerberos Service Tickets Requested |
production |
2026-05-13 |
| splunk |
Rubeus Command Line Parameters |
production |
2026-05-13 |
| splunk |
ServicePrincipalNames Discovery with PowerShell |
production |
2026-05-13 |
| splunk |
Windows PowerView SPN Discovery |
production |
2026-05-13 |
| splunk |
Windows Process With NetExec Command Line Parameters |
production |
2026-05-13 |
| sigma |
Kerberoasting Activity - Initial Query |
test |
2025-10-19 |
| sigma |
No Suitable Encryption Key Found For Generating Kerberos Ticket |
test |
2025-09-22 |
| sigma |
HackTool - RemoteKrbRelay Execution |
test |
2024-06-27 |
| sigma |
Uncommon Outbound Kerberos Connection - Security |
test |
2024-03-15 |
| sigma |
Potential SPN Enumeration Via Setspn.EXE |
test |
2023-10-23 |
| sigma |
HackTool - Rubeus Execution - ScriptBlock |
test |
2023-04-27 |
| sigma |
HackTool - Rubeus Execution |
stable |
2023-04-20 |
| sigma |
Potential CVE-2021-42287 Exploitation Attempt |
test |
2023-04-14 |
| sigma |
Potential CVE-2021-42278 Exploitation Attempt |
test |
2023-04-14 |
| sigma |
HackTool - KrbRelay Execution |
test |
2023-02-04 |
| sigma |
HackTool - KrbRelayUp Execution |
test |
2023-02-04 |
| sigma |
User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess' |
test |
2022-12-25 |
| sigma |
Register new Logon Process by Rubeus |
test |
2022-10-09 |
| sigma |
Suspicious Kerberos RC4 Ticket Encryption |
test |
2022-06-19 |
| sigma |
Kerberos Network Traffic RC4 Ticket Encryption |
test |
2021-11-27 |