admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Re-adding newline

Browse Source 
Adding newline back with proper format. Requires a backslash in front.
This commit is contained in:
pyth0n1c
2022-02-16 13:42:16 -08:00
committed by GitHub
parent 0be99ab0d6
commit 550a592f78
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml
+2 -1
View File
@@ -7,7 +7,8 @@ type: Anomaly
datamodel: []
description: The following hunting analytic leverages Kerberos Event 4769, A Kerberos service ticket was requested, to identify a potential kerberoasting attack
against Active Directory networks. Kerberoasting allows an adversary to request kerberos tickets for domain accounts typically used as service accounts and
attempt to crack them offline allowing them to obtain privileged access to the domain.
attempt to crack them offline allowing them to obtain privileged access to the domain.\
The detection calculates the standard deviation for each host and leverages the
3-sigma statistical rule to identify an unusual number service ticket requests. To customize this
analytic, users can try different combinations of the `bucket` span time and the