Sample rules
Windows AD ServicePrincipalName Added To Domain Account
- source: splunk
- technicques:
- T1098
Description
The following analytic detects the addition of a Service Principal Name (SPN) to a domain account. It leverages Windows Event Code 5136 and monitors changes to the servicePrincipalName attribute. This activity is significant because it may indicate an attempt to perform Kerberoasting, a technique where attackers extract and crack service account passwords offline. If confirmed malicious, this could allow an attacker to obtain cleartext passwords, leading to unauthorized access and potential lateral movement within the domain environment.
Detection logic
`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName OperationType="%%14674" ObjectClass=user
| stats values(ObjectDN) as ObjectDN by _time, Computer, SubjectUserName, AttributeValue
| rex field=ObjectDN "^CN=(?P<user>[a-zA-Z0-9!#$%&'@^_{}~.-]+),"
| rename Computer as dest, SubjectUserName as src_user
| `windows_ad_serviceprincipalname_added_to_domain_account_filter`
Windows AD Short Lived Domain Account ServicePrincipalName
- source: splunk
- technicques:
- T1098
Description
The following analytic identifies the addition and quick deletion of a Service Principal Name (SPN) to a domain account within 5 minutes. This detection leverages EventCode 5136 from the Windows Security Event Log, focusing on changes to the servicePrincipalName attribute. This activity is significant as it may indicate an attempt to perform Kerberoasting, a technique used to crack the cleartext password of a domain account offline. If confirmed malicious, this could allow an attacker to gain unauthorized access to sensitive information or escalate privileges within the domain environment.
Detection logic
`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName
| transaction ObjectDN AttributeValue startswith=(EventCode=5136 OperationType="%%14674") endswith=(EventCode=5136 OperationType="%%14675")
| eval short_lived=case((duration<300),"TRUE")
| search short_lived = TRUE
| rename ObjectDN as user
| `windows_ad_short_lived_domain_account_serviceprincipalname_filter`