Research

Incident teardowns, detection engineering, reverse engineering and network forensics. Filtered to T1558.003.

Collection

Format

Guided LabConstructed

Guided lab: six service tickets in four seconds

A burst of Kerberos service ticket requests from one workstation, every one of them legitimate as far as the domain controller is concerned. Find what makes the cluster abnormal, separate it from a legacy application, and say what the log cannot tell you.

21 Sept 2026about 40 minutes of workT1558.003lab constructed credential-access kerberos