Ravi Sir's Cyber Security Cards › Interview Cards
What Kerberos-related Event ID themes should a SOC analyst know?
What Kerberos-related Event ID themes should a SOC analyst know? Watch Event ID 4769 (service ticket requests) for anomalies: odd SPNs, bursts, or unusual hours. A sudden burst of 4769 for many service accounts can mean Kerberoasting. “4769 anomalies are a common SOC talking point for AD attacks.” T
Read card text
What this card says
Short answer
Watch Event ID 4769 (service ticket requests) for anomalies: odd SPNs, bursts, or unusual hours.
Example
A sudden burst of 4769 for many service accounts can mean Kerberoasting.
Say it in the interview
“4769 anomalies are a common SOC talking point for AD attacks.”
Why it matters
These events are an early sign of credential attacks in AD.
Learn more in the lesson: 47.5 Identity Attacks Awareness (Kerberos / PTH – defensive talking points only)