Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
54 detections
Filters
Last updated
All Time
Detection languages
26
9
6
3
3
Contributors
22
12
5
4
3
Categories
43
29
9
9
8
Platforms
52
6
1
Products / Services
38
31
31
9
5
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
IDS Classtypes
1
IDS Protocols
1
This rule detects potential Kerberos Golden Ticket attacks by identifying Kerberos authentication service (AS) request events (EventID 4768) where the ticket encryption type is 0x17 (RC4-HMAC) and the difference between the event generation time and the ticket's start time is greater than one day. This large time difference can indicate a forged ticket with an invalid timestamp, a common characteristic of Golden Tickets. The rule then summarizes these events by target username and computer, flagging instances where three or more such events occur.
This rule detects potential Golden Ticket attacks by looking for multiple successful Kerberos authentication events (EventID 4624) with LogonType 3 (network logon) and a specific TicketEncryptionType (0x17), originating from the same IP address and targeting the same user, within a short timeframe and with a long ticket lifetime. A Golden Ticket attack involves an adversary forging Kerberos Ticket Granting Tickets (TGTs) to gain unauthorized access to resources.
This rule detects a specific type of Kerberos AS-REQ (Authentication Service Request) that lacks pre-authentication, which is characteristic of a 'Golden Ticket' attack (ATT&CK T1558.001). The rule specifically looks for UDP traffic on port 88 (Kerberos default port) to the home network, containing the byte sequences '|30|' and '|a1 03 02 01 05|'. These content checks are indicative of the structure of a Kerberos AS-REQ packet without the expected pre-authentication data.
This hunt targets a documented Iranian MOIS-affiliated behaviour: re-executing DCSync
(MITRE ATT&CK T1003.006 — OS Credential Dumping: DCSync) after defenders reset
compromised account passwords, allowing actors to recollect current and historical NTLM
hashes and restore domain-wide access without repeating initial access stages.
(MITRE ATT&CK T1003.006 — OS Credential Dumping: DCSync) after defenders reset
compromised account passwords, allowing actors to recollect current and historical NTLM
hashes and restore domain-wide access without repeating initial access stages.
The analytic detects the execution of Mimikatz commands via PowerShell by leveraging PowerShell Script Block Logging (EventCode=4104). This method captures and logs the full command sent to PowerShell, allowing for the identification of suspicious activities such as Pass the Ticket, Pass the Hash, and credential dumping. This activity is significant as Mimikatz is a well-known tool used for credential theft and lateral movement. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information within the environment.
Detects scenarios where an attacker request a potential Golden ticket. Findings returned by this rule may not confirm at 100% that a Golden ticket was generated and further investigations would be required to confirm it. Another indicator (in case of a lazy Golden ticket) to check would be to check if the TargetUserName refers to an existing user in the domain.
Detects scenarios where an attacker used a forged Golden ticket to login on a remote host. Per default or if specified, the ticket will be forged using the builtin administrator account (SID *-500). However, and it frequent cases, a non suspicious user name will be specificied during the forge in order to evade security monitoring. The rule works based on this trick.
Detects scenarios where a suspicious password reset of the Krbtgt account is performed by attacker to issue a potential Golden ticket.
Detects scenarios where an attacker used a forged Golden ticket to login on a remote shared folder. Per default or if specified, the ticket will be forged using the builtin administrator account (SID *-500). However, and it frequent cases, a non suspicious user name will be specificied during the forge in order to evade security monitoring. The rule works based on this trick.
KQL Query from file: Detecting GOLDEN SAML Attack
This analytic detects Kerberos service ticket requests that utilize RC4 encryption, specifically by monitoring Kerberos Event 4769. The presence of RC4 encryption in these requests is a strong indicator of potential Golden Ticket attacks. In such attacks, adversaries forge Kerberos Granting Tickets (TGTs) using the NTLM password hash of the Krbtgt account to gain unauthorized and unrestricted access within an Active Directory environment. RC4 encryption is considered rare in modern networks, making its appearance in Kerberos service ticket requests highly suspicious and indicative of malicious activity. If confirmed, this activity could lead to lateral movement and remote code execution, compromising the entire network. It's important to note that this detection method might be bypassed if attackers opt to use an AES key instead of the NTLM hash for ticket forging.
This rule detects potential exploitation attempts of CVE-2021-42278, also known as "noPac" or "sAMAccountName spoofing". The exploit involves an attacker creating a computer object with known credentials, then clearing its ServicePrincipalName (SPN) attribute. This manipulation grants the attacker additional permissions on the object, allowing them to make further changes. The detection logic specifically looks for Kerberos Key Distribution Center (KDC) events (EventIDs 35, 36, 37, 38) which indicate anomalies in PAC (Privilege Attribute Certificate) or ticket requests, consistent with the post-exploitation phase of CVE-2021-42278 where forged tickets are used.
Page 3 of 3