ID | Technique | Tactic |
---|---|---|
T1558 | Steal or Forge Kerberos Tickets | Credential Access |
T1558.003 | Kerberoasting | Credential Access |
Detection: Kerberoasting spn request with RC4 encryption
Description
The following analytic detects potential Kerberoasting attacks by identifying Kerberos service ticket requests with RC4 encryption through Event ID 4769. It leverages specific Ticket_Options values commonly used by Kerberoasting tools. This activity is significant as Kerberoasting allows attackers to request service tickets for domain accounts, typically service accounts, and crack them offline to gain privileged access. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and further compromise of the Active Directory environment.
Search
1`wineventlog_security` EventCode=4769 ServiceName!="*$" (TicketOptions=0x40810000 OR TicketOptions=0x40800000 OR TicketOptions=0x40810010) TicketEncryptionType=0x17
2| stats count min(_time) as firstTime max(_time) as lastTime by Computer, user, service_id, service, TicketEncryptionType, TicketOptions
3| rename Computer as dest
4| `security_content_ctime(lastTime)`
5| `security_content_ctime(firstTime)`
6| `kerberoasting_spn_request_with_rc4_encryption_filter`
Data Source
Name | Platform | Sourcetype | Source |
---|---|---|---|
Windows Event Log Security 4769 | Windows | 'xmlwineventlog' |
'XmlWinEventLog:Security' |
Macros Used
Name | Value |
---|---|
security_content_ctime | convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$) |
kerberoasting_spn_request_with_rc4_encryption_filter | search * |
kerberoasting_spn_request_with_rc4_encryption_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Notable | Yes |
Rule Title | %name% |
Rule Description | %description% |
Notable Event Fields | user, dest |
Creates Risk Event | True |
Implementation
To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting Audit Kerberos Authentication Service
within Account Logon
needs to be enabled. Whithin environments where this type of communication is common, consider dropping the risk score and add throttling based on the user and service_id for 30 days. This will allow RBA to alert when there is an anomalous spike of these kerberoastable SPN requests within a short period of time.
Known False Positives
Older systems that support kerberos RC4 by default like NetApp may generate false positives. Filter as needed
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
User $user$ requested a service ticket for SPN $service_id$ with RC4 encryption | 72 | 90 | 80 |
References
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | XmlWinEventLog:Security |
XmlWinEventLog |
Integration | ✅ Passing | Dataset | XmlWinEventLog:Security |
XmlWinEventLog |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 8