The original post: /r/cybersecurity by /u/poxmasini on 2024-10-08 06:15:46.

So i get multiple kerberoasting alerts. I don’t know how to investigate them and find the reason why am I getting this alerts I will share the logs but will censor the sensetive information. I would like your help.

"A Kerberos service ticket was requested.

Account Information:

Account Name: svc_[email protected]

Account Domain: X.LOCAL

Logon GUID: {EADE7575-6166-3E86-5045-524DDB563693}

Service Information:

Service Name: svc_x

Service ID: S-1-5-21-1850975175-3636707609-1082838313-1122

Network Information: Client Address: ::ffff:10.100.10.13

Client Port: 53372 Additional Information:

Ticket Options: 0x40810000

Ticket Encryption Type: 0x17

Failure Code: 0x0

Transited Services: -