Kerberos AS authentications

id: 8abe561f-eecd-45cb-a0a3-152189d2c064
name: Kerberos AS authentications
description: |
  This query shows attempts to request Kerberos service ticket using the AS service, to monitor Kerberos AS authentications.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - IdentityLogonEvents
tactics:
- Credential Access
relevantTechniques: []
query: |
  // This query shows attempts to request Kerberos service ticket using the AS service which is usually providing TGTs (Ticket Granting Tickets).
  IdentityLogonEvents
  | where Application == "Active Directory"
  | where Protocol == "Kerberos"
  | where LogonType in("Resource access", "Failed logon")
  | extend Error =  AdditionalFields["Error"]
  | extend KerberosType = AdditionalFields['KerberosType']
  | where KerberosType == "KerberosAs"
  | extend Spns = AdditionalFields["Spns"]
  | extend DestinationDC = AdditionalFields["TO.DEVICE"]
  | where  Spns !contains "krbtgt" and Spns !contains "kadmin"
  | project Timestamp, ActionType, LogonType, AccountUpn, AccountSid, IPAddress, DeviceName, KerberosType, Spns, Error, DestinationDC, DestinationIPAddress, ReportId
version: 1.0.0
metadata:
    source:
        kind: Community
    author:
        name: Lior Shapira
    support:
        tier: Community
    categories:
        domains: [ "Security - Identity" ]