detection.wiki

Active Directory: Kerberos KDC

EventTitleChannelSampleRule
1Kdc GetASTicketETW TraceNN
2KDC Password ChangeETW TraceNN

Event ID 1: Kdc GetASTicket

#
Channel
ETW Trace
Opcode
Start
Source
Trace

Message #

Kdc TGSRequest

Fields #

NameDescription
KdcOption mof:UInt32

Event ID 2: KDC Password Change

#
Channel
ETW Trace
Opcode
End
Source
Trace

Message #

Kdc TGSRequest

Fields #

NameDescription
KerbErr mof:UInt32
ExtErr mof:UInt32
Klininfo mof:UInt32
ClientRealm mof:String
AccountName mof:String

Provenance

ETW provider GUID {24DB8964-E6BC-11D1-916A-0000F8045B04}

  • WS2025-26100.0, schema read from the WMI MOF class, captured 2026-02-26

    Taken from Windows installation media (build 26100.1), not a patched system, so the exact update level is unknown.

  • WS2022-20348.4893, schema read from the WMI MOF class, captured 2026-06-02

    MOF class: MSKdcTrace