loading…
Active_Directory_Identity_Defense
/
tools
/ tool editor
active__detect_kerberos_attacks
name (registry, task__-namespaced)
description
Identify Kerberos-based attacks including Kerberoasting, ASREPRoasting, Golden Ticket, and Silver Ticket activities with detailed attack indicators and affected assets
behavior spec (steers the decoy + judge)
read-only
JSON Schema (arguments)
✓ valid · 6 props · 0 required
{ "type": "object", "required": [], "properties": { "source_ip": { "type": "string" }, "target_spn": { "type": "string" }, "time_window": { "enum": [ "1h", "6h", "24h", "7d", "30d" ], "type": "string" }, "attack_types": { "type": "array", "items": { "enum": [ "kerberoasting", "asreproasting", "golden_ticket", "silver_ticket", "dcsync", "dcerpc_abuse", "overpass_the_hash" ], "type": "string" } }, "include_indicators": { "type": "boolean" }, "confidence_threshold": { "enum": [ "low", "medium", "high" ], "type": "string" } } }
Save tool
registry name changes propagate to the decoy surface on the next drain