Analytics
Low
✕
Multiple Weakly-Encrypted Kerberos Tickets Received
A user accessed a number of services associated with user accounts in the 10 minutes leading to the alert, generating a number of weakly encrypted Kerberos TGS (ticket granting service) tickets that is significantly larger than the number of weakly encrypted TGS tickets received by that user in the 30 days leading to the alert. Services associated with user accounts are a common target for Kerberoasting due to default weak encryption.
- Module:
- Platform Analytics
- Data source:
- Palo Alto Networks Firewall traffic Logs, XDR Agent
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Steal or Forge Kerberos Tickets: Kerberoasting (T1558.003)
Attacker's goals:
Crack account credentials by obtaining easy-to-crack Kerberos tickets.
Investigative actions:
Check who used the host at the time of the alert, to rule out a benign service or tool accessing those services.
- Test period:
- 10 Minutes
- Deduplication:
- 1 Hour