Open cardosec

Case C4BA63 · Blue team / DFIR · L3 Applied

Purple Team Beat the Rule

Practise as: Incident drill · InterviewLevel: L3 Applied

Live alertIn a purple-team exercise the red team Kerberoasted 30 service accounts and cracked two. Your Kerberoasting detection never fired: it alerts on event 4769 with RC4 encryption (0x17), and the red team requested AES tickets.

Interview questionYour Kerberoasting detection missed a purple-team attack. How do you fix the detection, not just this case?

  1. 01 What happened?
  2. 02 What is the impact?
  3. 03 What do you do?
Practise this card As Interview
What a strong answer covers

Try it out loud first. Then check yourself:

  1. The rule tested a common implementation, not the technique: attackers can request AES tickets too, they are just slower to crack.
  2. Detect the behaviour: one account requesting service tickets for many different SPNs in a short window, whatever the encryption type.
  3. Add a honeypot service account with an SPN that nothing legitimate uses; any ticket request for it is high confidence.
  4. Add the AES variant to your test suite, and review other rules for the same "one tool, one string" assumption.

If the interviewer pushes back

  • The two cracked accounts had 12-character passwords. What do you change beyond the detection?

Go deeper

More Blue team / DFIR cards

All Blue team / DFIR cards →

cardosec draws a security topic and gives you a clock: explain it out loud with no notes, then see what you covered and what you missed. Free during early access.

Reviewed 2026-10-09