Detection rules › Sigma
Replay Attack Detected
Detects possible Kerberos Replay Attack on the domain controllers when "KRB_AP_ERR_REPEAT" Kerberos response is sent to the client
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1558 Steal or Forge Kerberos Tickets |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Security-Auditing | 4649 | A replay attack was detected. |