Anomaly detection in certificate-based TGT requestsI identified several signs of attacks that use forged certificates inside the network and developed a Proof-of-Concept utility capable of finding artifacts in AD, as well as a number of detection logic rules that can be added to SIEM.
Source:
Anomaly detection in certificate-based TGT requests
