name: Unknown Process Using The Kerberos Protocol
id: c91a0852-9fbb-11ec-af44-acde48001122
version: 1
date: '2022-03-09'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies a process performing an outbound connection
  on port 88 used by default by the network authentication protocol Kerberos. Typically,
  on a regular Windows endpoint, only the lsass.exe process is the one tasked with
  connecting to the Kerberos Distribution Center to obtain Kerberos tickets. Identifying
  an unknown process using this protocol may be evidence of an adversary abusing the
  Kerberos protocol.
data_source:
- Sysmon Event ID 1
search:
  selection1:
    Image|endswith: lsass.exe
  condition: selection1
how_to_implement: To successfully implement this search, you must be ingesting your
  endpoint events and populating the Endpoint and Network data models.
known_false_positives: Custom applications may leverage the Kerberos protocol. Filter
  as needed.
references:
- https://stealthbits.com/blog/how-to-detect-overpass-the-hash-attacks/
- https://www.thehacker.recipes/ad/movement/kerberos/ptk
tags:
  analytic_story:
  - Active Directory Kerberos Attacks
  asset_type: Endpoint
  confidence: 60
  impact: 60
  message: ''
  mitre_attack_id:
  - T1550
  observable:
  - name: src_ip
    type: IP Address
    role:
    - Attacker
  - name: dest_ip
    type: IP Address
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 36
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550/rubeus/windows-security.log
    source: WinEventLog:Security
    sourcetype: WinEventLog
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550/rubeus/windows-sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog