false positives are possible, particularly from domain controllers that use kerberos ssp and loopback authentication. add known domain controllers to the `domain_controllers` lookup to suppress those results. filter as needed.

splunk

Techniques

Sample rules

Windows Kerberos Local Successful Logon

source: splunk
technicques:

Description

The following analytic identifies a local successful authentication event on a Windows endpoint using the Kerberos package. It detects EventCode 4624 with LogonType 3 and source address 127.0.0.1, indicating a login to the built-in local Administrator account. This activity is significant as it may suggest a Kerberos relay attack, a method attackers use to escalate privileges. If confirmed malicious, this could allow an attacker to gain unauthorized access to sensitive systems, execute arbitrary code, or create new accounts in Active Directory, leading to potential system compromise.

Detection logic

`wineventlog_security`
EventCode=4624
LogonType=3
AuthenticationPackageName=Kerberos
action=success
src=127.0.0.1


| fillnull

| stats count min(_time) as firstTime
              max(_time) as lastTime
  BY action app authentication_method
     dest dvc process
     process_id process_name process_path
     signature signature_id src
     src_port status subject
     user user_group vendor_product


| lookup update=true domain_controllers sAMAccountName as dest OUTPUT isDC

| where isnull(isDC)

| fields - isDC


| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `windows_kerberos_local_successful_logon_filter`