Detection rule
AS-REP Roasting detection (T1558.004)
AS-REP requests without pre-authentication from one source. GraphnAI raises an alert when it sees this in your domain controllers' security events.
How GraphnAI finds it
An OpenTelemetry collector sends the Windows Security log from your domain controllers to your GraphnAI server. GraphnAI checks each batch of events against every active rule.
This rule reads one event:
- 4768A Kerberos authentication ticket (TGT) was requested
It correlates matching events over a sliding 1-minute window and raises the alert when they reach its threshold of 3.
The alert names the source. Triage assesses the most privileged account it targeted, and that account's paths to Tier 0.
Tiered Fidelity™ level: Validated
Telemetry saw the activity itself. The alert names a source address rather than an account, so it marks no identity in the graph.
- TheoreticalConfigured in the directory. Nothing else checked.
- ConstrainedA constraint on it has been checked.
- ValidatedThis alertTelemetry has seen it in use.
How you respond with Select Fire™
The alert is keyed by its source address, so it has no Select Fire button.
- Full-AutoTriage never acts on it automatically. An attacker chooses the accounts it names, so acting on one would let the attacker pick the account to lock out.
- A person decidesRequire Kerberos pre-authenticationOn the targeted account.
Close the exposure first
This posture check finds the conditions this attack depends on, before anyone uses them.
MITRE ATT&CK® technique names: © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK® is a registered trademark of The MITRE Corporation.
See what's hitting your identities.
The Public Preview is free for 30 days from your first sync, on your own server.