Techniques
Sample rules
Windows Large Number of Computer Service Tickets Requested
- source: splunk
- technicques:
- T1135
- T1078
Description
The following analytic leverages Event ID 4769, A Kerberos service ticket was requested, to identify more than 30 computer service ticket requests from one source. When a domain joined endpoint connects to other remote endpoint, it will first request a Kerberos Service Ticket with the computer name as the Service Name. A user requesting a large number of computer service tickets for different endpoints could represent malicious behavior like lateral movement, malware staging, reconnaissance, etc.
Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold as needed.
Detection logic
`wineventlog_security` EventCode=4769 ServiceName="*$" TargetUserName!="*$"
| bucket span=5m _time
| stats dc(ServiceName) AS unique_targets values(ServiceName) as host_targets by _time, IpAddress, TargetUserName
| where unique_targets > 30
| `windows_large_number_of_computer_service_tickets_requested_filter`
Unusual Number of Kerberos Service Tickets Requested
- source: splunk
- technicques:
- T1558
- T1558.003
Description
The following hunting analytic leverages Kerberos Event 4769, A Kerberos service ticket was requested, to identify a potential kerberoasting attack against Active Directory networks. Kerberoasting allows an adversary to request kerberos tickets for domain accounts typically used as service accounts and attempt to crack them offline allowing them to obtain privileged access to the domain.
The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number service ticket requests. To customize this analytic, users can try different combinations of the bucket span time and the calculation of the upperBound field.
Detection logic
`wineventlog_security` EventCode=4769 ServiceName!="*$" TicketEncryptionType=0x17
| bucket span=2m _time
| stats dc(ServiceName) AS unique_services values(ServiceName) as requested_services by _time, src
| eventstats avg(unique_services) as comp_avg , stdev(unique_services) as comp_std by src
| eval upperBound=(comp_avg+comp_std*3)
| eval isOutlier=if(unique_services > 2 and unique_services >= upperBound, 1, 0)
| search isOutlier=1
| `unusual_number_of_kerberos_service_tickets_requested_filter`