name: Detect Kerberoasting
id: dabdd6d7-3e10-42be-8711-4e124f7a3850
version: 1
date: '2020-10-21'
author: Xiao Lin, Splunk
type: streaming
datamodel: []
description: This search detects a potential kerberoasting attack via service principal
  name requests
search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_time"),
  EventCode=map_get(input_event, "event_code"), TicketOptions=map_get(input_event,
  "ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"),
  ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event,
  "service_id") | where EventCode="4769" AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17"
  | first_time_event input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"]
  | where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID
  | eval start_time=_time, end_time=_time, body="TBD", entities="TBD" | select start_time,
  end_time, entities, body | into write_ssa_detected_events(); '
how_to_implement: The test data is converted from Windows Security Event logs generated
  from Attach Range simulation and used in SPL search and extended to SPL2
known_false_positives: Older systems that support kerberos RC4 by default NetApp may
  generate false positives
references:
- Initial ESCU implementation by Jose Hernandez and Patrick Bareiss
tags:
  analytic_story:
  - Credential Dumping
  cis20:
  - CIS 8
  - CIS 16
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1558.003
  nist:
  - DE.CM
  product:
  - UEBA for Security Cloud
  required_fields:
  - service_name
  - _time
  - event_code
  - ticket_encryption_type
  - service_id
  - ticket_options
  risk_severity: low
  security_domain: endpoint
