Detection rules › Splunk
Kerberos Pre-Authentication Flag Disabled with PowerShell
The following analytic detects the use of the Set-ADAccountControl PowerShell cmdlet with parameters that disable Kerberos Pre-Authentication. It leverages PowerShell Script Block Logging (EventCode=4104) to identify this specific command execution. Disabling Kerberos Pre-Authentication is significant because it allows adversaries to perform offline brute force attacks against user passwords using the AS-REP Roasting technique. If confirmed malicious, this activity could enable attackers to escalate privileges or maintain persistence within an Active Directory environment, posing a severe security risk.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1558.004 Steal or Forge Kerberos Tickets: AS-REP Roasting |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| PowerShell | 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
Stages and Predicates
Stage 1: search
search EventCode=4104 ScriptBlockText="*DoesNotRequirePreAuth:$true*" ScriptBlockText="*Set-ADAccountControl*"
Stage 2: fillnull
fillnull
Stage 3: stats
stats BY dest, signature, signature_id, user_id, vendor_product, EventID, Guid, Opcode, Name, Path, ProcessID, ScriptBlockId, ScriptBlockText
Stage 4: search
search
Stage 5: search
search
Stage 6: search
search `macro`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
ScriptBlockText | eq |
|
Neighbors
Broader alternatives (more inclusive than this rule)
These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.
- Potential PowerShell Obfuscation via Invalid Escape Sequences (drops 3 filters this rule applies)
- Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion (drops 3 filters this rule applies)
- Potential PowerShell Obfuscation via Character Array Reconstruction (drops 3 filters this rule applies)
- Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation (drops 3 filters this rule applies)
- Potential PowerShell Obfuscation via High Numeric Character Proportion (drops 3 filters this rule applies)
- Potential Dynamic IEX Reconstruction via Environment Variables (drops 3 filters this rule applies)
- Dynamic IEX Reconstruction via Method String Access (drops 3 filters this rule applies)
- PowerShell Obfuscation via Negative Index String Reversal (drops 3 filters this rule applies)
- Potential PowerShell Obfuscation via Reverse Keywords (drops 3 filters this rule applies)
- Potential PowerShell Obfuscation via String Concatenation (drops 3 filters this rule applies)
- Potential PowerShell Obfuscation via String Reordering (drops 3 filters this rule applies)
- Potential PowerShell Obfuscation via Special Character Overuse (drops 3 filters this rule applies)
- PowerShell 4104 Hunting (drops 2 filters this rule applies)