Detect AS-REP Roasting in Google Chronicle

// Detection 1: AS-REP Roasting — Single Account, No Preauthentication
rule asrep_roasting_no_preauth {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects AS-REP Roasting via Kerberos AS-REQ without preauthentication (Windows Event 4768, PreAuthType=0). Indicates DONT_REQ_PREAUTH is set on the target account, allowing unauthenticated TGT retrieval for offline cracking."
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "T1558.004"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://attack.mitre.org/techniques/T1558/004/"

  events:
    $e.metadata.event_type = "USER_RESOURCE_ACCESS"
    $e.metadata.product_event_type = "4768"
    $e.metadata.product_name = "Microsoft-Windows-Security-Auditing"
    $e.target.user.attribute.labels["PreAuthType"] = "0"
    not re.match($e.target.user.userid, `.*\$`)

  condition:
    $e
}

// Detection 2: Bulk AS-REP Roasting — 3+ Unique Accounts from Same Source in 10 Minutes
rule asrep_roasting_bulk_enumeration {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects bulk AS-REP Roasting where a single source IP requests AS-REP tickets for 3 or more distinct non-machine accounts within a 10-minute window. Characteristic of Rubeus asreproast or Impacket GetNPUsers.py targeting multiple accounts."
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "T1558.004"
    severity = "CRITICAL"
    priority = "CRITICAL"
    reference = "https://attack.mitre.org/techniques/T1558/004/"

  events:
    $e.metadata.event_type = "USER_RESOURCE_ACCESS"
    $e.metadata.product_event_type = "4768"
    $e.metadata.product_name = "Microsoft-Windows-Security-Auditing"
    $e.target.user.attribute.labels["PreAuthType"] = "0"
    not re.match($e.target.user.userid, `.*\$`)
    $src_ip = $e.principal.ip
    $victim = $e.target.user.userid

  match:
    $src_ip over 10m

  outcome:
    $account_count = count_distinct($victim)
    $total_requests = count($e)
    $accounts_list = array_distinct($victim)

  condition:
    #e >= 3 and $account_count >= 3
}