hard20 pts · first answer countsactive-directorywindows-logsthreat-detection

Detecting Kerberoasting

Which pattern in domain controller logs is the strongest indicator of Kerberoasting?

A.One user requesting many Event ID 4769 service tickets for different service accounts with RC4 encryption (0x17) in a short timeB.Many Event ID 4625 failures for the Administrator accountC.Event ID 4720 showing a new user account being createdD.Event ID 4740 showing an account being locked out

Discussion 0

Join free to post in the discussion.

Detecting Kerberoasting

Discussion 0

Related questions