hard20 pts · first answer countssiemwindows-eventskerberos
Failures that never show as 4625
An attacker sprays passwords against domain accounts using Kerberos. The DC shows few 4625 events. Which event ID should you search instead?
Discussion 0
Join free to post in the discussion.
Related questions
- What stats count by does in SPLCybersecurity Analyst
- Grouping with summarize in KQLCybersecurity Analyst
- Why logs go to a SIEMCybersecurity Analyst
- Why normalise to a common schemaCybersecurity Analyst
- What a Kerberos TGT is forCybersecurity Analyst
- Where the Kerberos KDC runsCybersecurity Analyst
- Default Kerberos ticket lifetimeCybersecurity Analyst
- What a SIEM is forCybersecurity Analyst