Detection: Windows Kerberos Local Successful Logon

Updated Date: 2026-07-27 ID: 8309c3a8-4d34-48ae-ad66-631658214653 Author: Michael Haag, Splunk Type: TTP Product: Splunk Enterprise Security

Description

The following analytic identifies a local successful authentication event on a Windows endpoint using the Kerberos package. It detects EventCode 4624 with LogonType 3 and source address 127.0.0.1, indicating a login to the built-in local Administrator account. This activity is significant as it may suggest a Kerberos relay attack, a method attackers use to escalate privileges. If confirmed malicious, this could allow an attacker to gain unauthorized access to sensitive systems, execute arbitrary code, or create new accounts in Active Directory, leading to potential system compromise.

Search

 1`wineventlog_security`
 2EventCode=4624
 3LogonType=3
 4AuthenticationPackageName=Kerberos
 5action=success
 6src=127.0.0.1
 7
 8
 9| fillnull
10
11| stats count min(_time) as firstTime
12              max(_time) as lastTime
13  BY action app authentication_method
14     dest dvc process
15     process_id process_name process_path
16     signature signature_id src
17     src_port status subject
18     user user_group vendor_product
19
20
21| lookup update=true domain_controllers sAMAccountName as dest OUTPUT isDC
22
23| where isnull(isDC)
24
25| fields - isDC
26
27
28| `security_content_ctime(firstTime)`
29
30| `security_content_ctime(lastTime)`
31
32| `windows_kerberos_local_successful_logon_filter`

Data Source

Name	Platform	Sourcetype	Source
Windows Event Log Security 4624	Windows	`'XmlWinEventLog'`	`'XmlWinEventLog:Security'`

Macros Used

Name	Value
security_content_ctime	`convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)`
windows_kerberos_local_successful_logon_filter	`search *`

windows_kerberos_local_successful_logon_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1558	Steal or Forge Kerberos Tickets	Credential Access

Exploitation

DE.CM

CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	Yes
Rule Title	`%name%`
Rule Description	`%description%`
Notable Event Fields	user, dest
Creates Intermediate Finding (Risk Event)	No

TTP detections generate a Finding (Notable) and may generate Intermediate Findings (Risk Events) for associated entities.

Implementation

To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4624 EventCode enabled. The Windows TA is also required. Populate the domain_controllers lookup with the hostnames that appear in the dest field for domain controllers in your environment.

Known False Positives

False positives are possible, particularly from domain controllers that use Kerberos SSP and loopback authentication. Add known domain controllers to the domain_controllers lookup to suppress those results. Filter as needed.

Associated Analytic Story

Finding

Title	Entity Field	Entity Type	Risk Score
A successful localhost Kerberos authentication event occurred on $dest$, possibly indicative of Kerberos relay attack.	dest	system	50

References

https://github.com/Dec0ne/KrbRelayUp

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`XmlWinEventLog:Security`	`XmlWinEventLog`
Integration	✅ Passing	Dataset	`XmlWinEventLog:Security`	`XmlWinEventLog`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 15