Sample rules
Kerberos Service Ticket Request Using RC4 Encryption
- source: splunk
- technicques:
- T1558
- T1558.001
Description
The following analytic detects Kerberos service ticket requests using RC4 encryption, leveraging Kerberos Event 4769. This method identifies potential Golden Ticket attacks, where adversaries forge Kerberos Granting Tickets (TGT) using the Krbtgt account NTLM password hash to gain unrestricted access to an Active Directory environment. Monitoring for RC4 encryption usage is significant as it is rare in modern networks, indicating possible malicious activity. If confirmed malicious, attackers could move laterally and execute code on remote systems, compromising the entire network. Note: This detection may be bypassed if attackers use the AES key instead of the NTLM hash.
Detection logic
`wineventlog_security` EventCode=4769 ServiceName="*$" (TicketOptions=0x40810000 OR TicketOptions=0x40800000 OR TicketOptions=0x40810010) TicketEncryptionType=0x17
| stats count min(_time) as firstTime max(_time) as lastTime by dest, service, service_id, TicketEncryptionType, TicketOptions
| `security_content_ctime(lastTime)`
| `security_content_ctime(firstTime)`
| `kerberos_service_ticket_request_using_rc4_encryption_filter`
Kerberos TGT Request Using RC4 Encryption
- source: splunk
- technicques:
- T1550
Description
The following analytic detects a Kerberos Ticket Granting Ticket (TGT) request using RC4-HMAC encryption (type 0x17) by leveraging Event 4768. This encryption type is outdated and its presence may indicate an OverPass The Hash attack. Monitoring this activity is crucial as it can signify credential theft, allowing adversaries to authenticate to the Kerberos Distribution Center (KDC) using a stolen NTLM hash. If confirmed malicious, this could enable unauthorized access to systems and resources, potentially leading to lateral movement and further compromise within the network.
Detection logic
`wineventlog_security` EventCode=4768 TicketEncryptionType=0x17 ServiceName!=*$
| stats count min(_time) as firstTime max(_time) as lastTime by ServiceName src_ip dest
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `kerberos_tgt_request_using_rc4_encryption_filter`