Replay Attack Detected (5a44727c-3b85-4713-8c44-4401d5499629)
Detects possible Kerberos Replay Attack on the domain controllers when "KRB_AP_ERR_REPEAT" Kerberos response is sent to the client
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Replay Attack Detected (5a44727c-3b85-4713-8c44-4401d5499629) | Sigma-Rules | Steal or Forge Kerberos Tickets - T1558 (3fc01293-ef5e-41c6-86ce-61f10706b64a) | Attack Pattern | 1 |