Analytics Informational
✕

Multiple TGT requests for users without Kerberos pre-authentication

Multiple TGT requests for users that do not require Kerberos pre-authentication were observed. This is typically a sign of an AS-REP attack.

Module:
Identity Analytics
Data source:
Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Steal or Forge Kerberos Tickets: AS-REP Roasting (T1558.004)
Attacker's goals:

Crack account credentials by obtaining an easy-to-crack Kerberos ticket.

Investigative actions:

Check who used the host at the time of the alert, to rule out a benign service or tool requesting weak Kerberos encryption.

Test period:
10 Minutes
Deduplication:
1 Day
2 variations:
  • An excessive number of TGT requests were sent for users that do not require Kerberos pre-authentication Low (parent: Informational)
  • A TGT request was sent for a user who does not require Kerberos pre-authentication Informational