Tagged “Splunk”

Detailed Guide to Detecting and Analyzing a Kerberoasting Attack in Active Directory Using Splunk

Published 30 October 2024 8 min read

Detecting and investigating a Kerberoasting attack on Active Directory in Splunk, from the attack steps to the event 4769 fields that give it away.

• Active Directory
• Event logs
• Splunk
• Incident response