hard20 pts · first answer countsactive-directory-securitywindows-event-logs

Detecting AS-REP roasting

Which pattern points to AS-REP roasting in domain controller logs?

A.Event 4768 TGT requests with Pre-Authentication Type 0 for accounts that have "Do not require Kerberos preauthentication" setB.Event 4769 requests for the krbtgt serviceC.Event 4624 logon type 2 on a workstationD.Event 4740 account lockouts across many users

Discussion 0

Join free to post in the discussion.

Detecting AS-REP roasting

Discussion 0

Related questions