Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

Filters

Clear

Count variations separately Analytics variations become rows of their own

Detector type ▾

Analytics 1 Analytics BIOC 2

Severity ▾

Low 3

Module / licence ▾

Platform Analytics 3

Data source (1) ▾

Analytics and correlation rules

XDR Agent with eXtended Threat Hunting (XTH) 8 XDR Agent 6 Windows Event Collector 4 Palo Alto Networks Firewall traffic Logs 3

3 detectors match the current filters. tactic: TA0006 ✕ technique: T1558 ✕

Download CSV

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics	Multiple Weakly-Encrypted Kerberos Tickets Received A user accessed a number of services associated with user accounts in the 10 minutes leading to the alert, generating a number of weakly encrypted Kerberos TGS (ticket granting service) tickets that is significantly larger than the number of weakly encrypted TGS tickets received by that user in the 30 days leading to the alert. Services associated with user accounts are a common target for Kerberoasting due to default weak encryption.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access
Analytics BIOC	Possible Kerberoasting without SPNs A user specifically requested weak and deprecated encryption in a Kerberos TGS request. This provides easy-to-crack hashes, and is typically a sign of a Kerberoasting attack. The requested service was specified by using a suspicious SPN type, which is often used by Kerberoasting tools to request by SAN instead of SPN.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access
Analytics BIOC	Weakly-Encrypted Kerberos Ticket Requested A user specifically requested weak and deprecated encryption in a Kerberos TGS request. This provides easy-to-crack hashes and is typically a sign of a Kerberoasting attack.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access