Detection engineering rabbit holes — parsing ASN.1 packets in KQL

This write-up presents a detection approach for Kerberos TGS-REQ patterns associated with Rubeus by parsing MDE DeviceNetworkEvents SamplePacketContent to reconstruct ticketOptions and match characteristic flag combinations (forwardable, renewable, renewable_ok) while excluding forwarded, with complete KQL provided. It highlights significant limitations—Rubeus opsec mode evasion, packet truncation in sampled telemetry, and incomplete MDE exposure of flags—that currently render the detection largely ineffective. Despite limited outcomes, the methodology and parsing techniques are applicable to other Kerberos tooling and network events.