PerfMon! What Is It Good For?
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
Performance Monitor (PerfMon) and its underlying ETW-based Active Directory Diagnostics data can serve as an alternative detection source for Kerberos roasting attacks, supplementing the traditional reliance on Windows Events 4768/4769. By capturing Active Directory Diagnostics traces, defenders can observe mass TGS requests (Kerberoasting), AS-REP Roasting activity against accounts without pre-authentication, and AS-based roasting spikes. PerfMon also surfaces obfuscated LDAP queries, adding visibility into adversary enumeration techniques. While not designed for real-time alerting at scale, these performance counters provide rich metadata — including client/server relationships and query patterns — that can enrich detection engineering efforts when fed into other analysis platforms.
