Possible Golden Ticket Usage Detected via Kerberos Anomalies
This detection identifies potential Golden Ticket attacks by correlating multiple Windows Security Event IDs that are indicative of forged Kerberos TGT usage. Specifically, it focuses on accounts requesting TGTs using uncommon or high-privilege encryption types (0x17, 0x18, 0x12), interacting with the krbtgt service, and logging in using elevated privileges and interactive logon types (4624, 4672). The rule filters out computer accounts and performs deduplication and correlation across a series of Kerberos-related activities, aiming to surface accounts that could be using forged Kerberos tickets for lateral movement or privilege escalation.
Splunk (SPL)
