← Back to SOC feed Coverage →

Kerberos AS authentications

kql MEDIUM Azure-Sentinel
IdentityLogonEvents
huntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-07T23:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may attempt to exploit Kerberos AS authentications to gain unauthorized access or escalate privileges within the network. SOC teams should proactively hunt for this behavior to identify potential credential theft or lateral movement tactics in their Azure Sentinel environment.

KQL Query

// This query shows attempts to request Kerberos service ticket using the AS service which is usually providing TGTs (Ticket Granting Tickets).
IdentityLogonEvents
| where Application == "Active Directory"
| where Protocol == "Kerberos"
| where LogonType in("Resource access", "Failed logon")
| extend Error =  AdditionalFields["Error"]
| extend KerberosType = AdditionalFields['KerberosType']
| where KerberosType == "KerberosAs"
| extend Spns = AdditionalFields["Spns"]
| extend DestinationDC = AdditionalFields["TO.DEVICE"]
| where  Spns !contains "krbtgt" and Spns !contains "kadmin"
| project Timestamp, ActionType, LogonType, AccountUpn, AccountSid, IPAddress, DeviceName, KerberosType, Spns, Error, DestinationDC, DestinationIPAddress, ReportId

Analytic Rule Definition

id: 8abe561f-eecd-45cb-a0a3-152189d2c064
name: Kerberos AS authentications
description: |
  This query shows attempts to request Kerberos service ticket using the AS service, to monitor Kerberos AS authentications.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - IdentityLogonEvents
tactics:
- Credential Access
relevantTechniques: []
query: |
  // This query shows attempts to request Kerberos service ticket using the AS service which is usually providing TGTs (Ticket Granting Tickets).
  IdentityLogonEvents
  | where Application == "Active Directory"
  | where Protocol == "Kerberos"
  | where LogonType in("Resource access", "Failed logon")
  | extend Error =  AdditionalFields["Error"]
  | extend KerberosType = AdditionalFields['KerberosType']
  | where KerberosType == "KerberosAs"
  | extend Spns = AdditionalFields["Spns"]
  | extend DestinationDC = AdditionalFields["TO.DEVICE"]
  | where  Spns !contains "krbtgt" and Spns !contains "kadmin"
  | project Timestamp, ActionType, LogonType, AccountUpn, AccountSid, IPAddress, DeviceName, KerberosType, Spns, Error, DestinationDC, DestinationIPAddress, ReportId
version: 1.0.0
metadata:
    source:
        kind: Community
    author:
        name: Lior Shapira
    support:
        tier: Community
    categories:
        domains: [ "Security - Identity" ]

Required Data Sources

Sentinel TableNotes
IdentityLogonEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Credential Access/Attempts to request Kerberos service ticket using the AS service.yaml