Sagan medium stable other

[WINDOWS-SECURITY] Kerberos - RC4 Encryption Still Supported by Domain Controller

[WINDOWS-SECURITY] Kerberos - RC4 Encryption Still Supported by Domain Controller

View Source

Detection Logic

alert any any -> $HOME_NET any (msg:"[WINDOWS-SECURITY] Kerberos - RC4 Encryption Still Supported by Domain Controller"; program:Security; event_id:4768; content:"Service Name
| 3a
| krbtgt"; content:"RC4"; distance:0; within:200; classtype:policy-violation; priority:3; parse_src_ip:1; threshold:type suppress,track by_src,count 1,seconds 86400; reference:url,attack.mitre.org/techniques/T1558/004/; metadata:createdOn 2026_06_30, updatedOn 2026_06_30; sid:5017970; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...