Skip to content

Hide Navigation Hide TOC

Uncommon Outbound Kerberos Connection (e54979bd-c5f9-4d6c-967b-a04b19ac4c74)

Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.

Cluster A Galaxy A Cluster B Galaxy B Level
Uncommon Outbound Kerberos Connection (e54979bd-c5f9-4d6c-967b-a04b19ac4c74) Sigma-Rules Pass the Ticket - T1550.003 (7b211ac6-c815-4189-93a9-ab415deca926) Attack Pattern 1
Uncommon Outbound Kerberos Connection (e54979bd-c5f9-4d6c-967b-a04b19ac4c74) Sigma-Rules Steal or Forge Kerberos Tickets - T1558 (3fc01293-ef5e-41c6-86ce-61f10706b64a) Attack Pattern 1
Use Alternate Authentication Material - T1550 (51a14c76-dd3b-440b-9c20-2bf91d25a814) Attack Pattern Pass the Ticket - T1550.003 (7b211ac6-c815-4189-93a9-ab415deca926) Attack Pattern 2