DFSP # 403 - Lateral Movement Kerberos Auth Events

07/11/2023 15 min
DFSP # 403 - Lateral Movement Kerberos Auth Events

Listen "DFSP # 403 - Lateral Movement Kerberos Auth Events"

Episode Synopsis

This week I'm going to cover an important Windows event that provides valuable information about authentication attempts and potential security breaches. The event may be used to identify compromised accounts, identify brute, force, attacks, or password spraying attacks. It may also be used to detect attack or probing activities. The artifact breakdown and triage methodology is coming up….