Detect Potential Kerberoast Activities

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Content Index


This query aim to detect if someone requests service tickets (where count => maxcount) The query requires trimming to set a baseline level for MaxCount Mitre Technique: Kerberoasting (T1558.003) @MattiasBorg82

Attribute Value
Type Analytic Rule
Solution Microsoft Defender XDR
ID 12134de5-361b-427c-a1a0-d43f40a593c4
Severity Medium
Status Available
Kind Scheduled
Tactics CredentialAccess
Techniques T1558.003
Required Connectors MicrosoftThreatProtection
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Selection Criteria Transformations Ingestion API Lake-Only
IdentityLogonEvents ActionType == "LogonSuccess" ?

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Analytic Rules · Back to Microsoft Defender XDR