Techniques
Sample rules
Kerberos Pre-Authentication Flag Disabled with PowerShell
- source: splunk
- technicques:
- T1558
- T1558.004
Description
The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the Set-ADAccountControl commandlet with specific parameters. Set-ADAccountControl is part of the Active Directory PowerShell module used to manage Windows Active Directory networks. As the name suggests, Set-ADAccountControl is used to modify User Account Control values for an Active Directory domain account. With the appropiate parameters, Set-ADAccountControl allows adversaries to disable Kerberos Pre-Authentication for an account to to easily perform a brute force attack against the user’s password offline leveraging the ASP REP Roasting technique. Red Teams and adversaries alike who have obtained privileges in an Active Directory network may use this technique as a backdoor or a way to escalate privileges.
Detection logic
`powershell` EventCode=4104 (ScriptBlockText = "*Set-ADAccountControl*" AND ScriptBlockText="*DoesNotRequirePreAuth:$true*")
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id
| rename Computer as dest
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `kerberos_pre_authentication_flag_disabled_with_powershell_filter`