DFSP # 403 - Lateral Movement Kerberos Auth Events

This week I'm going to cover an important Windows event that provides valuable information about authentication attempts and potential security breaches. The event may be used to identify compromised accounts, identify brute, force, attacks, or password spraying attacks. It may also be used to detect attack or probing activities. The artifact breakdown and triage methodology is coming up….

accounts artifact attack attacks auth authentication breaches brute compromised compromised accounts detect event events identify important information kerberos lateral movement may password password spraying security security breaches spraying week windows