Detection rules › Splunk
Suspicious Kerberos Service Ticket Request
The following analytic detects suspicious Kerberos Service Ticket (TGS) requests where the requesting account name matches the service name, potentially indicating an exploitation attempt of CVE-2021-42278 and CVE-2021-42287. This detection leverages Event ID 4769 from Domain Controller and Kerberos events. Such activity is significant as it may represent an adversary attempting to escalate privileges by impersonating a domain controller. If confirmed malicious, this could allow an attacker to take control of the domain controller, leading to complete domain compromise and unauthorized access to sensitive information.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1078.002 Valid Accounts: Domain Accounts |
| Persistence | T1078.002 Valid Accounts: Domain Accounts |
| Privilege Escalation | T1078.002 Valid Accounts: Domain Accounts |
| Defense Evasion | T1078.002 Valid Accounts: Domain Accounts |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Security-Auditing | 4769 | A Kerberos service ticket was requested. |
Stages and Predicates
Stage 1: search
search EventCode=4769
Stage 2: eval
eval ... using (ServiceName, TargetUserName)
Stage 3: where
where isSuspicious=1
Stage 4: rename
rename
Stage 5: rename
rename
Stage 6: table
table Error_Code, ServiceName, _time, dest, isSuspicious, src_ip, user
Stage 7: search
search `macro`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
isSuspicious | eq |
|
Neighbors
Stricter alternatives (narrower than this rule)
The rules below may be useful if you find the current rule is too noisy / lacks specificity.
- Kerberoasting spn request with RC4 encryption (adds 3 filters)
- Kerberos Service Ticket Request Using RC4 Encryption (adds 3 filters)
- Unusual Number of Computer Service Tickets Requested (adds 2 filters)
- Unusual Number of Kerberos Service Tickets Requested (adds 2 filters)
- Windows Large Number of Computer Service Tickets Requested (adds 2 filters)