Detection rules › By event

Microsoft-Windows-Security-Auditing event 4769

9 detection rules reference this event. View event page.

Sigma (3)

Kerberoasting Activity - Initial Query severity medium T1558.003
Kerberos Manipulation severity high T1212
Suspicious Kerberos RC4 Ticket Encryption severity medium T1558.003

Splunk (6)