Alan Smithee
99b640adaa
* Feature/call error message struct#66 (#69) * change way to use write trait #66 * change call error message struct #66 * erase finished TODO #66 * erase comment in error message format test #66 * resolve conflict #66 * Feature/call error message struct#66 (#71) * change ERROR writeln struct #66 * add Kerberoasting & AS-REP Roasting Rule #91 * fix rule and add alias #91
19 lines
549 B
YAML
19 lines
549 B
YAML
title: Kerberoasting
|
|
description: Adversaries may abuse a valid Kerberos ticket-granting ticket (TGT) or sniff network traffic to obtain a ticket-granting service (TGS) ticket that may be vulnerable to Brute Force.
|
|
enabled: true
|
|
author: Yea
|
|
logsource:
|
|
product: windows
|
|
detection:
|
|
selection:
|
|
Channel: Security
|
|
EventID: 4768
|
|
TicketEncryptionType: '0x17'
|
|
PreAuthType: 2
|
|
falsepositives:
|
|
- unknown
|
|
level: medium
|
|
output: 'Detected Kerberoasting Risk Activity.'
|
|
creation_date: 2021/4/31
|
|
updated_date: 2021/4/31
|