Threat Hunting Use Case: Windows Authentication Hygiene

This ReliaQuest blog-style use case describes a Windows authentication hygiene threat-hunting campaign: it recommends establishing baselines for usernames, hostnames, Kerberos/NTLM usage, and Windows security event logging to reduce noise and improve detection of authentication attacks (e.g., Kerberoasting, password spraying). The document lists relevant event IDs, MITRE techniques, investigative checks (naming conventions, weak Kerberos encryption, NTLM usage, privileged interactive logons, authentication failure trends), and outcomes to help security teams prioritize and refine hunts.