Add detection for kerberoasting

2026-06-08 17:07:13 +00:00 · 2021-03-17 20:21:25 -05:00
parent 166e451cf6
commit 90651e37c2
1 changed files with 15 additions and 0 deletions
@@ -0,0 +1,15 @@
+title: Kerberoasting
+description: Detects Kerberoasting through generic IndicatorName, excluding ManySPNRequests due to high FP.
+author: keyboardcrunch
+date: 17/03/2021
+modified: null
+mitre: 
+   tactic: Credential Access
+   technique: T1558
+   subtechnique: 003
+operating_system: linux
+query: IndicatorName StartsWith "Kerberoasting"
+false_positives: null
+tags: null
+references:
+   - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1558.003/T1558.003.md