The Client/Server Relationship — A Match Made In Heaven

This joint research post presents a correlation-driven detection approach for Kerberos-based attacks, advocating the fusion of primary Windows Security events (e.g., 4769) with secondary context (logon, process, and network telemetry) across client/server boundaries to reveal attacker intent; it includes Splunk examples and a PowerShell-based POC to detect uncommon U2U activity (via KDC option fuzzing and LDAP SPN validation to minimize false positives), and shows how to adapt this methodology to techniques like ASKTGT/ASKTGS, Kerberoasting, and AS-REP Roasting.