Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
173 detections
Filters
Last updated
All Time
Detection languages
81
28
22
18
8
Contributors
67
51
14
12
6
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
168
9
2
Products / Services
150
137
129
5
4
MITRE Techniques
99
90
40
29
22
CVEs
3
2
1
1
IDS Classtypes
3
1
1
IDS Protocols
3
2
Detects suspicious Kerberos Ticket Granting Ticket (TGT) requests where pre-authentication is disabled (Pre-Authentication Type = 0) and the ticket encryption type is RC4-HMAC (0x17). This combination is indicative of an AS-REP Roasting attack, where an adversary requests AS-REP messages for accounts without pre-authentication and attempts to crack the encrypted ticket offline to recover user passwords.
KQL Query from file: Kerberos Roasting Detection
'A service principal name (SPN) is used to uniquely identify a service instance in a Windows environment.
Each SPN is usually associated with a service account. Organizations may have used service accounts with weak passwords in their environment.
An attacker can try requesting Kerberos ticket-granting service (TGS) service tickets for any SPN from a domain controller (DC) which contains a hash of the Service account. This can then be used for offline cracking.
This hunting query looks for accounts that are generating excessive requests to different resources within the last hour compared with the previous 24 hours. Normal users would not make an unusually large number of request within a small time window. This is based on 4769 events which can be very noisy so environment based tweaking might be needed.'
Each SPN is usually associated with a service account. Organizations may have used service accounts with weak passwords in their environment.
An attacker can try requesting Kerberos ticket-granting service (TGS) service tickets for any SPN from a domain controller (DC) which contains a hash of the Service account. This can then be used for offline cracking.
This hunting query looks for accounts that are generating excessive requests to different resources within the last hour compared with the previous 24 hours. Normal users would not make an unusually large number of request within a small time window. This is based on 4769 events which can be very noisy so environment based tweaking might be needed.'
This query aim to detect if someone requests service tickets (where count => maxcount)
The query requires trimming to set a baseline level for MaxCount
Mitre Technique: Kerberoasting (T1558.003)
@MattiasBorg82
The query requires trimming to set a baseline level for MaxCount
Mitre Technique: Kerberoasting (T1558.003)
@MattiasBorg82
This query shows attempts to request Kerberos service ticket using the AS service, to monitor Kerberos AS authentications.
This rule detects suspicious Kerberos Ticket Granting Ticket (TGT) requests, specifically looking for events where a computer account (indicated by a '$' at the end of the `TargetUserName`) requests a TGT with a certificate thumbprint present. This behavior is often observed after an attacker has obtained a computer certificate, potentially through techniques like PetitPotam, and is attempting to leverage it to request Kerberos tickets using tools like Rubeus. The rule focuses on Windows Event ID 4768, which signifies a Kerberos authentication service ticket request. It filters out requests from the local host (::1) and those without a certificate thumbprint.
Detect suspicious Kerberos TGT requests.
Once an attacer obtains a computer certificate by abusing Active Directory Certificate Services in combination with PetitPotam, the next step would be to leverage the certificate for malicious purposes.
One way of doing this is to request a Kerberos Ticket Granting Ticket using a tool like Rubeus.
This request will generate a 4768 event with some unusual fields depending on the environment.
This analytic will require tuning, we recommend filtering Account_Name to the Domain Controller computer accounts.
Once an attacer obtains a computer certificate by abusing Active Directory Certificate Services in combination with PetitPotam, the next step would be to leverage the certificate for malicious purposes.
One way of doing this is to request a Kerberos Ticket Granting Ticket using a tool like Rubeus.
This request will generate a 4768 event with some unusual fields depending on the environment.
This analytic will require tuning, we recommend filtering Account_Name to the Domain Controller computer accounts.
The following analytic detects potential Kerberoasting attacks by identifying Kerberos service ticket requests with RC4 encryption through Event ID 4769. It leverages specific Ticket_Options values commonly used by Kerberoasting tools. This activity is significant as Kerberoasting allows attackers to request service tickets for domain accounts, typically service accounts, and crack them offline to gain privileged access. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and further compromise of the Active Directory environment.
This analytic detects Kerberos service ticket requests that utilize RC4 encryption, specifically by monitoring Kerberos Event 4769. The presence of RC4 encryption in these requests is a strong indicator of potential Golden Ticket attacks. In such attacks, adversaries forge Kerberos Granting Tickets (TGTs) using the NTLM password hash of the Krbtgt account to gain unauthorized and unrestricted access within an Active Directory environment. RC4 encryption is considered rare in modern networks, making its appearance in Kerberos service ticket requests highly suspicious and indicative of malicious activity. If confirmed, this activity could lead to lateral movement and remote code execution, compromising the entire network. It's important to note that this detection method might be bypassed if attackers opt to use an AES key instead of the NTLM hash for ticket forging.
The analytic detects a suspicious Kerberos Ticket Granting Ticket (TGT) request, identified by Event Code 4768. This detection leverages Windows Security Event Logs to identify TGT requests with unusual fields, specifically a non-empty CertThumbprint, which may indicate the use of tools like Rubeus following the exploitation of CVE-2021-36942 (PetitPotam). This activity is significant as it can signal an attacker leveraging a compromised certificate to request Kerberos tickets, potentially leading to unauthorized access. If confirmed malicious, this could allow attackers to escalate privileges and persist within the environment, posing a severe security risk.
The analytic detects the use of Rubeus command line parameters, a toolset for Kerberos attacks within Active Directory environments. It leverages Endpoint Detection and Response (EDR) data to identify specific command-line arguments associated with actions like ticket manipulation, kerberoasting, and password spraying. This activity is significant as Rubeus is commonly used by adversaries to exploit Kerberos for privilege escalation and lateral movement. If confirmed malicious, this could lead to unauthorized access, persistence, and potential compromise of sensitive information within the network.
This analytic detects suspicious Kerberos Service Ticket (TGS) requests where the requesting account name matches the service name. This behavior is indicative of an exploitation attempt of CVE-2021-42278 and CVE-2021-42287, often referred to as sAMAccountName spoofing. The detection leverages Windows Event ID 4769 from Domain Controllers. Such activity is significant as it may represent an adversary attempting to escalate privileges by impersonating a domain controller, which could lead to complete domain compromise and unauthorized access to sensitive information.
This analytic identifies an unusual number of Kerberos service ticket requests (Event 4769) from a single host, which can indicate a Kerberoasting attack. It calculates the standard deviation of unique service requests per user and source, using the 3-sigma rule to detect anomalies. Kerberoasting allows adversaries to obtain and crack service tickets offline, potentially leading to privileged access and escalation within an Active Directory environment.
This analytic detects the execution of the `Get-DomainSPNTicket` commandlet, which is part of the PowerView tool, by monitoring PowerShell Script Block Logging (EventCode=4104). This commandlet is used to request Kerberos service tickets for specified Service Principal Names (SPNs). Detecting this activity is critical because it can indicate attempts to perform Kerberoasting, a technique where attackers extract SPN account passwords for offline cracking. If this activity is confirmed to be malicious, it could lead to unauthorized access to sensitive accounts, potentially resulting in privilege escalation and further compromise of the network.
The analytic detects a Kerberos Ticket Granting Ticket (TGT) request using RC4-HMAC encryption (type 0x17) by leveraging Event 4768. This encryption type is outdated and its presence may indicate an OverPass The Hash attack. Monitoring this activity is crucial as it can signify credential theft, allowing adversaries to authenticate to the Kerberos Distribution Center (KDC) using a stolen NTLM hash. If confirmed malicious, this could enable unauthorized access to systems and resources, potentially leading to lateral movement and further compromise within the network.
This analytic detects suspicious Kerberos Ticket Granting Ticket (TGT) requests that may indicate exploitation of CVE-2021-42278 and CVE-2021-42287. It identifies sequences where a computer account is renamed (Event ID 4781) and immediately followed by a TGT request (Event ID 4768) for that same account. This behavior is significant as it could represent an attempt to escalate privileges by impersonating a Domain Controller, potentially leading to elevated access and control over the domain environment.
This analytic detects a computer account requesting a Kerberos ticket, which is unusual as typically user accounts request these tickets. This detection leverages Windows Security Event Logs, specifically EventCode 4768, to identify instances where the TargetUserName ends with a dollar sign ($), indicating a computer account. This activity is significant because it may indicate the use of tools like KrbUpRelay or other Kerberos-based attacks. If confirmed malicious, this could allow attackers to impersonate computer accounts, potentially leading to unauthorized access and lateral movement within the network.
The analytic detects a high volume of Kerberos service ticket requests (more than 30) from a single source within a 5-minute window, specifically focusing on requests with computer names as the Service Name (Event ID 4769). This behavior may indicate malicious activities such as lateral movement, malware staging, or reconnaissance, potentially leading to unauthorized access and network compromise.
The analytic identifies an unusual number of Kerberos service ticket requests (Event ID 4769) originating from a single client address and account. It uses statistical analysis, specifically standard deviation and the 3-sigma rule, to detect anomalies. This activity is significant as it may indicate malicious behavior such as lateral movement, malware staging, or reconnaissance, potentially leading to unauthorized access to multiple endpoints and further compromise.
This rule detects potential exploitation attempts of CVE-2021-42278, also known as "noPac" or "sAMAccountName spoofing". The exploit involves an attacker creating a computer object with known credentials, then clearing its ServicePrincipalName (SPN) attribute. This manipulation grants the attacker additional permissions on the object, allowing them to make further changes. The detection logic specifically looks for Kerberos Key Distribution Center (KDC) events (EventIDs 35, 36, 37, 38) which indicate anomalies in PAC (Privilege Attribute Certificate) or ticket requests, consistent with the post-exploitation phase of CVE-2021-42278 where forged tickets are used.
This rule detects the use of `System.IdentityModel.Tokens.KerberosRequestorSecurityToken` within PowerShell script blocks. This specific class is used to request Kerberos service tickets (TGS) for a given Service Principal Name (SPN). This behavior is commonly observed in Kerberoasting attacks (T1558.003) where an attacker requests service tickets to crack their hashes offline, or in some cases, during the initial stages of a silver ticket attack (T1558.002) to gather SPNs. A successful execution of such a script would typically output the SPNs for the targeted endpoint.
Page 8 of 9