Detection rules › Splunk

Kerberos TGT Request Using RC4 Encryption

Author
Mauricio Velazco, Splunk
Source
upstream

The following analytic detects a Kerberos Ticket Granting Ticket (TGT) request using RC4-HMAC encryption (type 0x17) by leveraging Event 4768. This encryption type is outdated and its presence may indicate an OverPass The Hash attack. Monitoring this activity is crucial as it can signify credential theft, allowing adversaries to authenticate to the Kerberos Distribution Center (KDC) using a stolen NTLM hash. If confirmed malicious, this could enable unauthorized access to systems and resources, potentially leading to lateral movement and further compromise within the network.

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1550 Use Alternate Authentication Material
Lateral MovementT1550 Use Alternate Authentication Material

Event coverage

ProviderEvent IDTitle
Security-Auditing4768A Kerberos authentication ticket (TGT) was requested.

Stages and Predicates

Stage 1: search

search EventCode=4768 ServiceName!="*$" TicketEncryptionType=0x17

Stage 2: stats

stats BY ServiceName, src_ip, dest

Stage 3: search

search

Stage 4: search

search

Stage 5: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventCodeeq
  • 4768 corpus 10 (splunk 10)
ServiceNamene
  • *$
TicketEncryptionTypeeq
  • 0x17 corpus 7 (splunk 4, sigma 3)