Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Kerberos Traffic from Unusual Process

Identifies network connections to the standard Kerberos port from an unusual process. On Windows, the only process that normally performs Kerberos traffic from a domain joined host is lsass.exe.

ATT&CK coverage

Credential Access

T1558Steal or Forge Kerberos Tickets29 detections cover this technique
- T1558.003Kerberoasting 33 detections cover this technique

Lateral Movement

T1550Use Alternate Authentication Material66 detections cover this technique
- T1550.003Pass the Ticket 12 detections cover this technique

Detection requirements

Log source category: event_index

What the source says

What fires this without an attack behind it

HTTP traffic on a non standard port. Verify that the destination IP address is not related to a Domain Controller.

Tagged by the source as

Data Source: Elastic DefendData Source: SentinelOneDomain: EndpointOS: WindowsResources: Investigation GuideTactic: Credential AccessUse Case: Threat Detection

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.