Detection rules › Splunk
Windows Kerberos Local Successful Logon
The following analytic identifies a local successful authentication event on a Windows endpoint using the Kerberos package. It detects EventCode 4624 with LogonType 3 and source address 127.0.0.1, indicating a login to the built-in local Administrator account. This activity is significant as it may suggest a Kerberos relay attack, a method attackers use to escalate privileges. If confirmed malicious, this could allow an attacker to gain unauthorized access to sensitive systems, execute arbitrary code, or create new accounts in Active Directory, leading to potential system compromise.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1558 Steal or Forge Kerberos Tickets |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Security-Auditing | 4624 | An account was successfully logged on. |
Stages and Predicates
Stage 1: search
search AuthenticationPackageName="Kerberos" EventCode=4624 LogonType=3 action="success" src="127.0.0.1"
Stage 2: fillnull
fillnull
Stage 3: stats
stats BY action, app, authentication_method, dest, dvc, process, process_id, process_name, process_path, signature, signature_id, src, src_port, status, subject, user, user_group, vendor_product
Stage 4: search
search
Stage 5: search
search
Stage 6: search
search `macro`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
AuthenticationPackageName | eq |
|
EventCode | eq |
|
LogonType | eq |
|
action | eq |
|
src | eq |
|
Neighbors
Broader alternatives (more inclusive than this rule)
These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.
- Potential Account Takeover - Mixed Logon Types (drops 5 filters this rule applies)
- Potential Account Takeover - Logon from New Source IP (drops 5 filters this rule applies)
- External Remote SMB Logon from Public IP (drops 4 filters this rule applies)