ATT&CK technique
View on MITRE ATT&CK →
T1558.004
AS-REP Roasting
Credential Access
8 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Kerberos Pre-authentication Disabled for User | production | 2026-09-18 |
| elastic | Suspicious Kerberos Authentication Ticket Request | production | 2026-09-18 |
| splunk | Kerberos Pre-Authentication Flag Disabled in UserAccountControl | production | 2026-05-13 |
| splunk | Kerberos Pre-Authentication Flag Disabled with PowerShell | production | 2026-05-13 |
| splunk | Disabled Kerberos Pre-Authentication Discovery With Get-ADUser | production | 2026-05-13 |
| splunk | Windows Process With NetExec Command Line Parameters | production | 2026-05-13 |
| splunk | Rubeus Command Line Parameters | production | 2026-05-13 |
| splunk | Disabled Kerberos Pre-Authentication Discovery With PowerView | production | 2026-05-13 |