TLDR Tech / InfoSec
Capture the Kerberos Flag: Detecting Kerberos Anomalies
Kerberos TGT requests emit Windows Events with the Id 4768 and include a wealth of information about the request. The user can compare the request flags against those commonly set by tools such as Metasploit, those included in IoCs from malware campaigns, or those that differ from an established baseline to identify suspicious activity. This post includes a breakdown of the flags and a KQL query for hunting suspicious ones.
Read the full story