T1558.003 Kerberoasting — Detection Rules

Detection workspace for T1558.003 Kerberoasting: 15 Sigma sources, 1 Atlas concepts and 1 anomaly models. No live detection validation.

Source-backed rule directory

Kerberos Network Traffic RC4 Ticket Encryption · test · medium · {"product":"zeek","service":"kerberos"}
Kerberoasting Activity - Initial Query · test · medium · {"product":"windows","service":"security"}
Register new Logon Process by Rubeus · test · high · {"product":"windows","service":"security"}
Uncommon Outbound Kerberos Connection - Security · test · medium · {"product":"windows","service":"security"}
Suspicious Kerberos RC4 Ticket Encryption · test · medium · {"product":"windows","service":"security"}
User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess' · test · high · {"product":"windows","service":"security"}
No Suitable Encryption Key Found For Generating Kerberos Ticket · test · low · {"product":"windows","service":"system"}
HackTool - Rubeus Execution - ScriptBlock · test · high · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
Suspicious Kerberos Ticket Request via PowerShell Script - ScriptBlock · test · high · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
HackTool - KrbRelay Execution · test · high · {"category":"process_creation","product":"windows"}
HackTool - RemoteKrbRelay Execution · test · high · {"category":"process_creation","product":"windows"}
HackTool - KrbRelayUp Execution · test · high · {"category":"process_creation","product":"windows"}
HackTool - Rubeus Execution · stable · critical · {"category":"process_creation","product":"windows"}
Suspicious Kerberos Ticket Request via CLI · experimental · high · {"category":"process_creation","product":"windows"}
Potential SPN Enumeration Via Setspn.EXE · test · medium · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

T1558.003 Kerberoasting

COUNT(service_ticket_request BY account, 10m) >= threshold AND DISTINCT_COUNT(service_name) >= threshold -> ALERT; MATCH(weak_ticket_encryption_type) -> ALERT

Anomaly models

Unusual service-ticket requests — T1558.003 Kerberoasting

Comparison unit: account-service ticket relationships.

Expected behavior: accounts request tickets for a stable service set and encryption distribution.

Deviation: fan-out across services, request burst, or rare encryption category.

ATT&CK analytic guidance

DET0157 Detect Kerberoasting Attempts (T1558.003)

AN0444 Analytic 0444

Detects Kerberoasting attempts by monitoring for anomalous Kerberos TGS requests (Event ID 4769) with RC4 encryption (etype 0x17), accounts requesting an unusual number of service tickets in a short period, or service accounts targeted outside normal usage baselines. Also correlates suspicious process activity (e.g., Mimikatz invoking LSASS access) with Kerberos ticket anomalies.

Connected ecosystem references

Linked tags

rule_source_available Burst Anomaly Fan-Out Anomaly Rare-Category Anomaly

Simulation, tools and telemetry

T1558.003 simulation workspace

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing anomaly research

Original publication snapshot · Anomaly Detection Atlas

Connected anomaly research

Curated research views reached through an exact source technique, a catalog model, or a reviewed collection reference. These are navigation associations, not claims of detector effectiveness or sensor equivalence.

Multi-Event Correlation

Telemetry contracts · Maintained query examples · Validation and blind spots

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.