Windows: Uncommon Outbound Kerberos Traffic on Port 88
Alerts on initiated outbound connections to Kerberos TCP/88 from unexpected Windows processes.
- Product
- windows
- Category
- network_connection
- Author
- Ilyas Ochkov, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2019-10-24
- Updated
- 2026-07-31
ATT&CK techniques
Defense Evasion → Lateral MovementRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags outbound network connections to the Kerberos default port (88) that were initiated by the host. Such traffic can indicate attacker activity related to lateral movement or delegation-based privilege escalation. The detection relies on Windows network connection telemetry that includes destination port, initiation status, and the initiating process image, while filtering out common processes to reduce expected benign activity.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Uncommon Outbound Kerberos Traffic on Port 88"
id: a154412d-766c-4cb9-bee2-3c017033e1d6
related:
- id: eca91c7c-9214-47b9-b4c5-cb1d7e4f2350
type: similar
- id: e54979bd-c5f9-4d6c-967b-a04b19ac4c74
type: derived
status: test
description: This rule flags outbound network connections to the Kerberos default port (88) that were initiated by the host. Such traffic can indicate attacker activity related to lateral movement or delegation-based privilege escalation. The detection relies on Windows network connection telemetry that includes destination port, initiation status, and the initiating process image, while filtering out common processes to reduce expected benign activity.
references:
- https://github.com/GhostPack/Rubeus
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_susp_outbound_kerberos_connection.yml
author: Ilyas Ochkov, oscd.community, Huntrule Team
date: 2019-10-24
modified: 2024-03-15
tags:
- attack.credential-access
- attack.t1558
- attack.lateral-movement
- attack.t1550.003
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort: 88
Initiated: "true"
filter_main_lsass:
Image: C:\Windows\System32\lsass.exe
filter_optional_chrome:
Image:
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
- C:\Program Files\Google\Chrome\Application\chrome.exe
filter_optional_firefox:
Image:
- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
- C:\Program Files\Mozilla Firefox\firefox.exe
filter_optional_tomcat:
Image|endswith: \tomcat\bin\tomcat8.exe
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Web Browsers and third party application might generate similar activity. An initial baseline is required.
level: medium
license: DRL-1.1