From 254dc75c6c2adcbe5b350e0dee1662fa742998c2 Mon Sep 17 00:00:00 2001
From: Mahdi Hamedani Nezhad <150752864+thegreatmhn@users.noreply.github.com>
Date: Thu, 23 Oct 2025 15:30:00 -0700
Subject: [PATCH] Create active-directory-as-rep-roasting-detection.log

---
 .../T1558.004/active-directory-as-rep-roasting-detection.log    | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 datasets/attack_techniques/T1558.004/active-directory-as-rep-roasting-detection.log

diff --git a/datasets/attack_techniques/T1558.004/active-directory-as-rep-roasting-detection.log b/datasets/attack_techniques/T1558.004/active-directory-as-rep-roasting-detection.log
new file mode 100644
index 00000000..ac71fe40
--- /dev/null
+++ b/datasets/attack_techniques/T1558.004/active-directory-as-rep-roasting-detection.log
@@ -0,0 +1,2 @@
+<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4768</EventID><Version>1</Version><Level>0</Level><Task>14339</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2025-10-23T15:14:48.5074585Z'/><EventRecordID>424879</EventRecordID><Correlation/><Execution ProcessID='816' ThreadID='3740'/><Channel>Security</Channel><Computer>DC.example.com</Computer><Security/></System><EventData><Data Name='TargetUserName'>mahdi</Data><Data Name='TargetDomainName'>example.COM</Data><Data Name='TargetSid'>EXAMPLE\mahdi</Data><Data Name='ServiceName'>krbtgt</Data><Data Name='ServiceSid'>EXAMPLE\krbtgt</Data><Data Name='TicketOptions'>0x50800000</Data><Data Name='Status'>0x0</Data><Data Name='TicketEncryptionType'>0x12</Data><Data Name='PreAuthType'>0</Data><Data Name='IpAddress'>::ffff:192.168.184.200</Data><Data Name='IpPort'>58958</Data><Data Name='CertIssuerName'></Data><Data Name='CertSerialNumber'></Data><Data Name='CertThumbprint'></Data><Data Name='ResponseTicket'>AVZqoO56bSPHTlUcxgvpJ5+260pfj0P39jtDcHgcBk8=
+</Data></EventData></Event>