PerfMon! What Is It Good For? | Huntress

This post demonstrates how Windows Performance Monitor (PerfMon) and ETW Active Directory diagnostics can be used to detect Kerberos credential-theft techniques—Kerberoasting, AS-REP Roasting, and a newly described ‘Roasting from the AS’—by capturing mass TGS/AS requests, LDAP queries (including obfuscated queries), and spikes in Kerberos-related performance counters; it presents experiment results using Rubeus and PowerView and recommends leveraging PerfMon counters as supplementary telemetry to enrich detection and response.