SOC Analyst interview question

How would you detect a Kerberos Golden Ticket attack?

What interviewers are really testing

• Knowledge of Kerberos artifacts and Event IDs
• Anomaly patterns: ticket lifetime, missing AS-REQ
• Remediation knowledge (KRBTGT double reset)

A strong answer framework

1. Event 4769 anomalies: abnormal ticket lifetimes, missing PAC
2. TGT renewals without a matching 4768 (AS-REQ)
3. Anomalous 4624 logon types for privileged accounts
4. Monitor KRBTGT reset events (4723/4724)
5. Baseline normal ticket behavior per environment

Follow-ups you should be ready for

• Why rotate KRBTGT twice?
• Golden vs silver ticket differences?

More real SOC Analyst interview questions

• A domain controller is making outbound connections to an external IP on port 443. No maintenance is scheduled. How do you investigate?
• A user reports clicking a link in a phishing email. Walk me through your response.
• How would you write a Splunk search to detect multiple failed logins followed by a success?