mdecrevoisier high experimental sigma

Account set with Kerberos pre-authentication not required (AS-REP Roasting)

Detects scenarios where an attacker set an account with Kerberos pre-authentication not required to perform offline brutforce. Account with this status can be checked with the following command > "Get-ADUser -Filter 'useraccountcontrol -band 4194304' -Properties useraccountcontrol".

View Source

Detection Logic

{
  "selection": {
    "EventID": 4738,
    "UserAccountControl": "%%2096"
  },
  "condition": "selection"
}

False Positives

  • ⚠ None

Field Validations

Loading…

Comments (0)

Loading comments...