H3-2023-0004¶

Detection: Kerberoasting

Description¶

Kerberoasting was detected in the environment from an asset that was likely not Horizon3.ai. Kerberoasting is a tactic used by attackers once they have gained initial access to obtain more credentials and conduct lateral movement.

Impact¶

An attacker may have had access to your environment. The events listed in the should be investigated to determine if an attacker was present.

References¶

• Detecting Kerberoasting
• CWE-916: Use of Password Hash With Insufficient Computational Effort