Analytics BIOC Low
✕

Weakly-Encrypted Kerberos Ticket Requested

A user specifically requested weak and deprecated encryption in a Kerberos TGS request. This provides easy-to-crack hashes and is typically a sign of a Kerberoasting attack.

Module:
Platform Analytics
Data source:
Palo Alto Networks Firewall traffic Logs, XDR Agent
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Steal or Forge Kerberos Tickets: Kerberoasting (T1558.003)
Attacker's goals:

Crack account credentials by obtaining an easy-to-crack Kerberos ticket.

Investigative actions:

Check who used the host at the time of the alert to rule out a benign service or tool requesting weak Kerberos encryption.

Test period:
N/A (single event)
Deduplication:
30 Days
1 variation:
  • Weakly-Encrypted Kerberos Ticket Requested on a sensitive server Medium (parent: Low)