From 56e77dccfbccea464cc8261817b7553fae96c87d Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 16 Jun 2021 16:15:33 -0400 Subject: [PATCH] Update ssa___detect_kerberoasting.yml --- detections/endpoint/ssa___detect_kerberoasting.yml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/ssa___detect_kerberoasting.yml b/detections/endpoint/ssa___detect_kerberoasting.yml index 60ca2943d3..0b885c63d0 100644 --- a/detections/endpoint/ssa___detect_kerberoasting.yml +++ b/detections/endpoint/ssa___detect_kerberoasting.yml @@ -7,17 +7,21 @@ type: streaming datamodel: [] description: This search detects a potential kerberoasting attack via service principal name requests -search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_time"), +search: ' | from read_ssa_enriched_events() + | eval _time=map_get(input_event, "_time"), EventCode=map_get(input_event, "event_code"), TicketOptions=map_get(input_event, "ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"), ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event, - "service_id") | where EventCode="4769" AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" + "service_id"), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", + null), dest_device_id=ucast(map_get(input_event, "dest_device_id") + | where EventCode="4769" AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" | first_time_event input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"] | where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID | eval start_time=_time, end_time=_time, body=create_map(["EventCode", EventCode, "ServiceName", ServiceName, "TicketOptions", TicketOptions, "TicketEncryptionType", - TicketEncryptionType]), entities="TBD" | select start_time, end_time, entities, - body | into write_null(); ' + TicketEncryptionType]), entities = mvappend( ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null))| select start_time, end_time, entities, body | into write_ssa_detected_events();' how_to_implement: The test data is converted from Windows Security Event logs generated from Attach Range simulation and used in SPL search and extended to SPL2 known_false_positives: Older systems that support kerberos RC4 by default NetApp may