Analytics BIOC
Low
✕
Possible Kerberoasting without SPNs
A user specifically requested weak and deprecated encryption in a Kerberos TGS request. This provides easy-to-crack hashes, and is typically a sign of a Kerberoasting attack. The requested service was specified by using a suspicious SPN type, which is often used by Kerberoasting tools to request by SAN instead of SPN.
- Module:
- Platform Analytics
- Data source:
- Palo Alto Networks Firewall traffic Logs, XDR Agent
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Steal or Forge Kerberos Tickets: Kerberoasting (T1558.003)
Attacker's goals:
Crack service account credentials by obtaining an easy-to-crack Kerberos ticket.
Investigative actions:
Check who used the host at the time of the alert to rule out a benign service or tool requesting weak Kerberos encryption.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
1 variation:
- Possible Kerberoasting without SPNs on a sensitive server Medium (parent: Low)