AN0405
Analytic 0405
Windows
Detects forged Kerberos Golden Tickets by correlating anomalous Kerberos ticket lifetimes, unexpected encryption types (e.g., RC4 in modern domains), malformed fields in logon/logoff events, and TGS requests without preceding TGT requests. Also monitors for abnormal patterns of access associated with elevated privileges across multiple systems.
WinEventLog:Security
EventCode=4672, 4634
WinEventLog:Security
EventCode=4769
WinEventLog:Sysmon
EventCode=10
[TicketLifetimeThreshold]
Kerberos TGT ticket lifetime exceeding default domain duration; tunable to environment-specific policies.
[AllowedEncryptionTypes]
Valid encryption algorithms for Kerberos tickets; anomalies (e.g., RC4) may indicate forgery.
[PrivilegedAccountPatterns]
Baseline of privileged accounts expected to perform Kerberos operations; deviations indicate suspicious activity.
[ProcessAllowlist]
Expected processes interacting with lsass.exe; deviations may indicate credential dumping.