I am working to detect kerberoasting activity and I am referring this link. It states that an account cannot be requesting several different service names within a second or two of each other. What is the threshold for this? I do see some account accessing 3 SPNs in 1 second.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.