Microsoft Sentinel Generates Kerberoasting Alerts for Lepide Monitoring

Issue

Microsoft Sentinel/Defender XDR may generate alerts such as:

• Steal or Forge Kerberos Tickets (T1558)

• Kerberoasting (T1558.003)

when Lepide monitors multiple Windows machines using a domain service account.

Cause

Lepide uses Windows/Kerberos authentication to remotely collect event logs and audit information from monitored machines.

When multiple machines are monitored simultaneously, the Lepide service account may request a large number of Kerberos service tickets within a short period. This activity can resemble Kerberoasting or domain reconnaissance to Microsoft Sentinel, resulting in a security alert.

Standard Windows SPNs such as HOST and RPCSS may appear in the alert as part of this legitimate communication.

The alert does not necessarily indicate malicious activity. The source server, service account, and requested SPNs should be verified to confirm that the activity is associated with Lepide.

Resolution

• Verify the activity
  Confirm that the Kerberos requests originate from the authorized Lepide server and service account.

• Configure a security exception
  If the activity is confirmed as legitimate Lepide monitoring, the security team can create a narrowly scoped exclusion for the relevant Sentinel/Defender detection.

• Verify Kerberos encryption
  Ensure the Lepide service account is configured to use appropriate Kerberos encryption types, such as AES128/AES256, according to the organization's security policy.

• Consider local agents
  Where applicable, using Lepide local agents can reduce remote Kerberos authentication requests by collecting audit information locally on monitored machines.

Verification

After applying the appropriate configuration, verify that:

• Lepide continues collecting audit data successfully.

• Reports continue receiving data.

• The expected Kerberos-related alerts no longer trigger for legitimate Lepide activity.