Kerberos User Enumeration

Cortex XDR Analytics Alert Reference by data source

Product
Cortex XDR
Last date published
2024-11-18
Category
Analytics Alert Reference
Order
data source

Synopsis

Activation Period

14 Days

Training Period

30 Days

Test Period

1 Hour

Deduplication Period

1 Day

Required Data

  • Requires one of the following data sources:
    • Palo Alto Networks Platform Logs
      OR
    • XDR Agent

Detection Modules

Identity Analytics

Detector Tags

ATT&CK Tactic

Discovery (TA0007)

ATT&CK Technique

Account Discovery (T1087)

Severity

Medium

Description

A high amount of Kerberos principal unknown errors were generated on users in the last hour.
This may be indicative of Kerberos user enumeration.

Attacker's Goals

The attacker may attempt to gain an initial foothold in the domain by enumerating users and finding service accounts.

Investigative actions

  • Check whether any service principal names (SPNs) were not set correctly, as they will always return a principal unknown error.