skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-service-account-abuse

Detect service account abuse through anomalous logon types, Kerberoasting indicators, and lateral movement patterns.

954|172|Updated Mar 13, 2026
Search Tags:#detection#threat hunting#siem#kerberoasting#mitre attack#service accounts#Active Directory
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-service-account-abuse
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-service-account-abuse
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/detecting-service-account-abuse
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-service-account-abuse

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Service accounts are high-value targets because they hold elevated privileges and their misuse blends into normal background activity. This Skill gives threat hunters a structured workflow to detect interactive logons, Kerberoasting precursors, privilege escalation, and lateral movement involving service accounts before attackers establish persistence.

Core Features & Use Cases

  • Anomalous Logon Detection: Hunt Windows Event 4624 Type 2 and Type 10 logons for service accounts that should only show Type 3 or Type 5 activity.
  • Kerberoasting Detection: Identify T1558.003 via 4769 TGS requests with RC4 ticket encryption (0x17) against service account SPNs.
  • Baseline Deviation Analysis: Compare each service account's source hosts and activity hours against a 30-day baseline to surface lateral movement.
  • Use Case: A SOC analyst investigates a backup service account that suddenly authenticates to a domain controller off-hours; the Skill guides hypothesis formation, SIEM/EDR queries, validation with Atomic T1558.003 tests, and structured reporting.

Quick Start

Hunt for service accounts showing interactive or RDP logons in the last 30 days and flag any that deviate from their baseline source hosts.

Frequently Asked Questions about detecting-service-account-abuse

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect service account abuse in Active Directory?▼

Hunt Windows Event 4624 for Type 2 (interactive) and Type 10 (RemoteInteractive/RDP) logons tied to service accounts, which should normally only show Type 3 or Type 5. Correlate with 4769 TGS requests using RC4 encryption to catch Kerberoasting precursors.

What Windows event IDs indicate service account compromise?▼

Event 4624 with unusual logon types (2 or 10) for service accounts is the primary signal. Event 4769 with ticket encryption type 0x17 (RC4) against a service account SPN indicates Kerberoasting activity under T1558.003.

Which SIEM and EDR tools work for service account hunting?▼

The workflow supports Splunk with SPL, Microsoft Defender for Endpoint with KQL, Elastic Security, and CrowdStrike Falcon. Sysmon and Windows Security Event Log forwarding provide the underlying telemetry, and Sigma rules offer cross-platform detection logic.

Why do service account detections generate false positives?▼

Patch windows, clustering operations, and admin troubleshooting create legitimate off-hours service account activity. Tune detections by allowlisting known maintenance windows and jump hosts, and validate rules with Atomic T1558.003 Kerberoast tests.

What are the limitations of logon-type-based service account detection?▼

Attackers can reuse the account's expected Type 3 logon from an already-allowed host, and gMSA abuse can look fully legitimate. Volume and destination anomalies against a 30-day baseline, not logon type alone, catch these evasions.

Related Skills

Explore More Software Engineering Skills→
YukiIto1999YukiIto1999

detecting-kerberoasting-attacks

Detect Kerberoasting indicators from Windows Event 4769 and 4624 logs.

Community
Advanced
makashmakash
2

pypi-supply-chain-response

Identify compromised PyPI packages and guide six-phase incident response.

Community
Advanced
hypnguyen1209hypnguyen1209
338

threat-hunting

Hunt threats across infrastructure and extract IOC data mapped to MITRE ATT&CK.

Community
Advanced
Renzo-TognellaRenzo-Tognella

detecting-anomalous-authentication-patterns

Detect anomalous authentication patterns in logs using UEBA and machine learning.

Community
Advanced