Get-ADUser Enumeration Using UserAccountControl Flags — Detection Rule

Detects AS-REP roasting is an attack that is often-overlooked. It is not very common as you have to explicitly set accounts that do not require pre-authentication.

Read the full analysis on IntelFusions