mdecrevoisier high experimental sigma

Account set with Kerberos DES encryption activated (weakness introduction)

Detects scenarios where an attacker set an account with DES Kerberos encryption to perform ticket brutforce.

View Source

Detection Logic

{
  "selection": {
    "EventID": 4738,
    "UserAccountControl": "%%2095"
  },
  "condition": "selection"
}

False Positives

  • ⚠ None

Field Validations

Loading…

Comments (0)

Loading comments...