mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
mvelazco
71 lines
3.0 KiB
YAML
71 lines
3.0 KiB
YAML
name: Suspicious Ticket Granting Ticket Request
|
|
id: d77d349e-6269-11ec-9cfe-acde48001122
|
|
version: 1
|
|
date: '2021-12-21'
|
|
author: Mauricio Velazco, Splunk
|
|
type: Hunting
|
|
datamodel:
|
|
- Endpoint
|
|
description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller
|
|
Impersonation (CVE-2021-42287) exploitation chain, adversaries will need to request
|
|
a Kerberos Ticket Granting Ticket (TGT) on behalf of the newly created and renamed
|
|
computer account. The TGT request will be preceded by a computer account name event.
|
|
This analytic leverages Event Id 4781, `The name of an account was changed` and
|
|
event Id 4768 `A Kerberos authentication ticket (TGT) was requested` to correlate
|
|
a sequence of events where the new computer account on event id 4781 matches the
|
|
request account on event id 4768. This behavior could represent an exploitation
|
|
attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation.
|
|
search: ' `wineventlog_security` (EventCode=4781 Old_Account_Name="*$" New_Account_Name!="*$")
|
|
OR (EventCode=4768 Account_Name!="*$") | eval RenamedComputerAccount = coalesce(New_Account_Name,
|
|
mvindex(Account_Name,0)) | transaction RenamedComputerAccount startswith=(EventCode=4781)
|
|
endswith=(EventCode=4768) | eval short_lived=case((duration<2),"TRUE") | search
|
|
short_lived = TRUE | table _time, ComputerName, EventCode, Account_Name,RenamedComputerAccount,
|
|
short_lived |`suspicious_ticket_granting_ticket_request_filter`'
|
|
how_to_implement: To successfully implement this search, you need to be ingesting
|
|
Domain Controller and Kerberos events. The Advanced Security Audit policy setting
|
|
`Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
|
|
known_false_positives: A computer account name change event inmediately followed by
|
|
a kerberos TGT request with matching fields is unsual. However, legitimate behavior
|
|
may trigger it. Filter as needed.
|
|
references:
|
|
- https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
|
|
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278
|
|
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287
|
|
tags:
|
|
analytic_story:
|
|
- sAMAccountName Spoofing and Domain Controller Impersonation
|
|
- Active Directory Kerberos Attacks
|
|
automated_detection_testing: passed
|
|
confidence: 60
|
|
context:
|
|
- Source:Endpoint
|
|
- Stage:Privilege Escalation
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log
|
|
impact: 100
|
|
kill_chain_phases:
|
|
- Exploitation
|
|
message: A suspicious TGT was requested was requested
|
|
mitre_attack_id:
|
|
- T1078
|
|
- T1078.002
|
|
observable:
|
|
- name: ComputerName
|
|
type: Endpoint
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- EventCode
|
|
- Old_Account_Name
|
|
- New_Account_Name
|
|
- Account_Name
|
|
- ComputerName
|
|
risk_score: 60
|
|
security_domain: endpoint
|
|
asset_type: Endpoint
|