admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update ssa___detect_kerberoasting.yml

Browse Source
This commit is contained in:
Jose Enrique Hernandez
2021-06-16 16:15:33 -04:00
committed by GitHub
parent ec1a205bb5
commit 56e77dccfb
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___detect_kerberoasting.yml
+8 -4
View File
@@ -7,17 +7,21 @@ type: streaming
datamodel: []
description: This search detects a potential kerberoasting attack via service principal
name requests
search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_time"),
search: ' | from read_ssa_enriched_events()
| eval _time=map_get(input_event, "_time"),
EventCode=map_get(input_event, "event_code"), TicketOptions=map_get(input_event,
"ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"),
ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event,
"service_id") | where EventCode="4769" AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17"
"service_id"), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
null), dest_device_id=ucast(map_get(input_event, "dest_device_id")
| where EventCode="4769" AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17"
| first_time_event input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"]
| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID
| eval start_time=_time, end_time=_time, body=create_map(["EventCode", EventCode,
"ServiceName", ServiceName, "TicketOptions", TicketOptions, "TicketEncryptionType",
TicketEncryptionType]), entities="TBD" | select start_time, end_time, entities,
body | into write_null(); '
TicketEncryptionType]), entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null))| select start_time, end_time, entities, body | into write_ssa_detected_events();'
how_to_implement: The test data is converted from Windows Security Event logs generated
from Attach Range simulation and used in SPL search and extended to SPL2
known_false_positives: Older systems that support kerberos RC4 by default NetApp may