mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
33 lines
2.0 KiB
YAML
33 lines
2.0 KiB
YAML
name: Active Directory Kerberos Attacks
|
|
id: 38b8cf16-8461-11ec-ade1-acde48001122
|
|
version: 1
|
|
date: '2022-02-02'
|
|
author: Mauricio Velazco, Splunk
|
|
description: Monitor for activities and techniques associated with Kerberos based attacks within with Active Directory environments.
|
|
narrative: Kerberos, initially named after Cerberus, the three-headed dog in Greek mythology, is a network authentication protocol that allows computers and
|
|
users to prove their identity through a trusted third-party. This trusted third-party issues Kerberos tickets using symmetric encryption to allow users access
|
|
to services and network resources based on their privilege level. Kerberos is the default authentication protocol used on Windows Active Directory networks since
|
|
the introduction of Windows Server 2003. With Kerberos being the backbone of Windows authentication, it is commonly abused by adversaries across the different phases
|
|
of a breach including initial access, privilege escalation, defense evasion, credential access, lateral movement, etc.\
|
|
This Analytic Story groups detection use cases in which the Kerberos protocol is abused. Defenders can leverage these analytics to detect and hunt for adversaries engaging in
|
|
Kerberos based attacks.
|
|
references:
|
|
- https://en.wikipedia.org/wiki/Kerberos_(protocol)
|
|
- https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/2a32282e-dd48-4ad9-a542-609804b02cc9
|
|
- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
|
|
- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
|
|
- https://attack.mitre.org/techniques/T1558/003/
|
|
- https://attack.mitre.org/techniques/T1550/003/
|
|
- https://attack.mitre.org/techniques/T1558/004/
|
|
tags:
|
|
analytic_story: Active Directory Kerberos Attacks
|
|
category:
|
|
- Adversary Tactics
|
|
- Account Compromise
|
|
- Lateral Movement
|
|
- Privilege Escalation
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
usecase: Advanced Threat Detection |