PowerShell Kerberos Ticket Dump

  1[metadata]
  2creation_date = "2023/07/26"
  3integration = ["windows"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects PowerShell script block content that references LSA Kerberos authentication-package access patterns, including
 11explicit Kerberos ticket message types or dynamic Kerberos package lookup. These patterns are consistent with tooling
 12that enumerates, retrieves, or exports Kerberos tickets from memory for credential reuse or lateral movement.
 13"""
 14from = "now-9m"
 15index = ["logs-windows.powershell*", "winlogbeat-*"]
 16language = "kuery"
 17license = "Elastic License v2"
 18name = "PowerShell Kerberos Ticket Dump"
 19references = ["https://github.com/MzHmO/PowershellKerberos/blob/main/dumper.ps1"]
 20risk_score = 73
 21rule_id = "fddff193-48a3-484d-8d35-90bb3d323a56"
 22severity = "high"
 23tags = [
 24    "Domain: Endpoint",
 25    "OS: Windows",
 26    "Use Case: Threat Detection",
 27    "Tactic: Credential Access",
 28    "Data Source: PowerShell Logs",
 29    "Resources: Investigation Guide",
 30    "Noise: Low",
 31    "Performance: Normal",
 32    "Rule Type: Custom Query (KQL)",
 33    "Platform: Windows",
 34]
 35timestamp_override = "event.ingested"
 36type = "query"
 37
 38query = '''
 39event.category:process and host.os.type:windows and
 40  powershell.file.script_block_text : (
 41    "LsaCallAuthenticationPackage" and
 42    (
 43      "KerbRetrieveEncodedTicketMessage" or
 44      "KerbQueryTicketCacheMessage" or
 45      "KerbQueryTicketCacheExMessage" or
 46      "KerbQueryTicketCacheEx2Message" or
 47      "KerbRetrieveTicketMessage" or
 48      "KerbDecryptDataMessage" or
 49      ("LsaLookupAuthenticationPackage" and "kerberos" and "KERB_RETRIEVE_TKT_REQUEST")
 50    )
 51  )
 52'''
 53
 54note = """## Triage and analysis
 55
 56### Investigating PowerShell Kerberos Ticket Dump
 57
 58#### Possible investigation steps
 59
 60- What does the reconstructed script block attempt to do with Kerberos tickets?
 61  - Why: PowerShell Script Block Logging can split one script across events; interpretation before reconstruction can miss export, helper, or cleanup logic.
 62  - Focus: recover fragments on the same `host.id` with `powershell.file.script_block_id`, order by `powershell.sequence` of `powershell.total`, then read reconstructed `powershell.file.script_block_text`. $investigate_2
 63  - Implication: escalate when the full script retrieves, decrypts, serializes, or outputs tickets through explicit Kerberos message types, dynamic Kerberos package lookup, "LsaCallAuthenticationPackage", "ExtractTicket", or "Ticketb64"; lower concern only when reconstruction stays query-only, fits a recognized diagnostic or declared test, and shows no export or follow-on logic.
 64
 65- Does the reconstructed script try to gain SYSTEM or enumerate other logon sessions?
 66  - Focus: reconstructed `powershell.file.script_block_text`, checking for "Invoke-AsSystem", token duplication or impersonation calls, LSA registration/connect calls, "LsaEnumerateLogonSessions", and "GetLogonSessionData".
 67  - Implication: escalate when the script attempts SYSTEM impersonation, LSA registration, or multi-session enumeration because ticket access may extend beyond the alerting user; current-session cache queries remain suspicious but carry less scope impact when no retrieval/export evidence appears.
 68
 69- Can endpoint process telemetry explain how this PowerShell instance was launched?
 70  - Focus: recover the matching process via `host.id` and `process.pid` before interpreting lineage; review `process.entity_id`, `process.command_line`, `process.parent.command_line`, `process.Ext.token.integrity_level_name`, and `process.Ext.authentication_id`. $investigate_3
 71  - Hint: If no process start event is found, expand the window because PowerShell can predate the script block; if still absent, keep launch, process-scoped file review, and auth-bridge context unresolved.
 72  - Implication: escalate when the recovered launch shows encoded commands, remote-admin launchers, Office or browser parents, unexpected elevation, or SYSTEM-adjacent execution; missing endpoint process telemetry leaves launch chain, process-scoped file review, and auth-bridge context unresolved, not benign.
 73
 74- Do the script source or output artifacts show ticket material was staged or exported?
 75  - Focus: source `file.path` and `file.name`, plus file activity for `host.id`, `process.pid`, and recovered `process.entity_id` when available. Look for ".kirbi", ticket text output, archives, temp/user-writable paths, or cleanup. $investigate_4
 76  - Implication: escalate when file evidence confirms exported tickets, archives, staging, or cleanup; if source path is absent or file telemetry is missing but reconstruction emits "Ticketb64" or ticket objects, treat the case as unresolved high concern rather than benign.
 77
 78- Do authentication events explain the PowerShell session or show follow-on credential use?
 79  - Focus: same-host/user Windows Security events for `event.code` 4624, 4625, or 4648; review `source.ip`, `winlog.event_data.AuthenticationPackageName`, and `winlog.logon.type` where present. $investigate_5
 80  - Hint: After process recovery, search backward from the recovered process `@timestamp`, bridge `process.Ext.authentication_id` to `winlog.event_data.TargetLogonId`, and search 4648 on `winlog.event_data.SubjectLogonId` for explicit-credential targets.
 81  - Implication: escalate when session origin, authentication package, logon type, explicit-credential target, or later remote or privileged logons conflict with the expected diagnostic or test workflow. Missing authentication telemetry is unresolved, not benign.
 82
 83- If local evidence remains suspicious or incomplete, do related alerts widen user or host scope?
 84  - Focus: related alerts for `user.id` showing credential access, execution, or lateral movement. $investigate_0
 85  - Hint: compare `host.id` alerts only after local script, launch, artifact, and authentication review. $investigate_1
 86  - Implication: broaden containment and hunting when either view shows connected credential access, delivery, persistence, or lateral movement; quiet related alerts keep scope local only when the local evidence also supports a recognized workflow.
 87
 88- Escalate when script, SYSTEM or multi-session behavior, launch, artifacts, authentication, or related alerts show unauthorized ticket retrieval or follow-on credential use; close only when reconstruction and recovery bind one exact benign diagnostic, red-team, or lab workflow and outside confirmation covers gaps; preserve and escalate when evidence is mixed, incomplete, or dependent telemetry is missing.
 89
 90### False positive analysis
 91
 92- Kerberos diagnostics, identity troubleshooting, red-team, or lab validation can trigger this rule when reconstruction is query-oriented or scoped to an authorized test. Confirm no unexplained SYSTEM impersonation, multi-session enumeration, "Ticketb64" output, export paths, or cleanup; `user.id`, `host.id`, and any `file.path` or `file.name` align with the declared workflow; launch and authentication recovery do not contradict it. Record first-time verified-benign activity, but wait for stable recurrence before exceptioning.
 93- Ticket retrieval, decryption, or base64 ticket output is an operational anti-pattern outside confirmed testing. Do not close on a Kerberos troubleshooting claim when reconstruction or follow-on evidence shows export, reuse, or unexplained privilege/session expansion.
 94- Build exceptions from the minimum confirmed pattern: `user.id`, `host.id`, stable `file.path` or `file.name`, declared test or diagnostic scope, and recovered launch context when available. Avoid exceptions on Kerberos API strings, `user.name`, `host.name`, or `host.id` alone.
 95
 96### Response and remediation
 97
 98- If confirmed benign, reverse any temporary containment and document the exact workflow evidence: reconstructed `powershell.file.script_block_text`, fragment identifiers, `user.id`, `host.id`, source `file.path` or `file.name`, recovered launch context when available, and bounded authentication evidence. Create an exception only after the same pattern recurs without contradictory export or reuse evidence.
 99- If suspicious but unconfirmed, preserve the reconstructed script, `powershell.file.script_block_id`, `powershell.sequence`, `powershell.total`, SYSTEM or multi-session indicators, source and output artifacts, recovered launch details when available, and authentication evidence such as `winlog.event_data.TargetLogonId` and `source.ip`. Apply reversible containment first, such as heightened monitoring or temporary account/session restrictions, and isolate the host only if ticket export, reuse, or privileged session creation appears.
100- If confirmed malicious, preserve the artifact set before destructive actions, then isolate the host with endpoint response or escalate to the team that can contain it. Contain affected accounts after recording evidence for the identities and sessions involved.
101- If ticket retrieval or reuse is confirmed, purge tickets on affected hosts, reset impacted credentials, and prioritize privileged, service, and delegation-capable accounts. Consider domain-wide Kerberos actions only with identity-team approval and evidence of broader TGT or KRBTGT exposure.
102- Eradicate only the unauthorized scripts, exported tickets, archives, persistence mechanisms, and delivery artifacts identified during the investigation, then remediate the entry path.
103- After containment, hunt for the same reconstructed script fragments, "Ticketb64" output patterns, related file artifacts, and post-alert authentication patterns across other hosts.
104"""
105
106setup = """## Setup
107
108PowerShell Script Block Logging must be enabled to generate the events used by this rule (e.g., 4104).
109Setup instructions: https://ela.st/powershell-logging-setup
110"""
111
112[rule.investigation_fields]
113field_names = [
114    "@timestamp",
115    "user.name",
116    "user.id",
117    "user.domain",
118    "powershell.file.script_block_text",
119    "powershell.file.script_block_id",
120    "powershell.sequence",
121    "powershell.total",
122    "file.path",
123    "file.directory",
124    "file.name",
125    "process.pid",
126    "host.name",
127    "host.id",
128    "powershell.file.script_block_length"
129]
130
131[transform]
132
133[[transform.investigate]]
134label = "Alerts associated with the user"
135description = ""
136providers = [
137  [
138    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
139    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
140  ]
141]
142relativeFrom = "now-48h/h"
143relativeTo = "now"
144
145[[transform.investigate]]
146label = "Alerts associated with the host"
147description = ""
148providers = [
149  [
150    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
151    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
152  ]
153]
154relativeFrom = "now-48h/h"
155relativeTo = "now"
156
157[[transform.investigate]]
158label = "Script block fragments for the same script"
159description = ""
160providers = [
161  [
162    { excluded = false, field = "powershell.file.script_block_id", queryType = "phrase", value = "{{powershell.file.script_block_id}}", valueType = "string" },
163    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
164  ]
165]
166relativeFrom = "now-1h"
167relativeTo = "now"
168
169[[transform.investigate]]
170label = "Process events for the PowerShell instance"
171description = ""
172providers = [
173  [
174    { excluded = false, field = "process.pid", queryType = "phrase", value = "{{process.pid}}", valueType = "string" },
175    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
176    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" }
177  ]
178]
179relativeFrom = "now-1h"
180relativeTo = "now"
181
182[[transform.investigate]]
183label = "File events for the PowerShell process"
184description = ""
185providers = [
186  [
187    { excluded = false, field = "process.pid", queryType = "phrase", value = "{{process.pid}}", valueType = "string" },
188    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
189    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" }
190  ]
191]
192relativeFrom = "now-1h"
193relativeTo = "now"
194
195[[transform.investigate]]
196label = "Windows Security authentication events for the user"
197description = ""
198providers = [
199  [
200    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
201    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" },
202    { excluded = false, field = "event.code", queryType = "phrase", value = "4624", valueType = "string" }
203  ],
204  [
205    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
206    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" },
207    { excluded = false, field = "event.code", queryType = "phrase", value = "4625", valueType = "string" }
208  ],
209  [
210    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
211    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" },
212    { excluded = false, field = "event.code", queryType = "phrase", value = "4648", valueType = "string" }
213  ]
214]
215relativeFrom = "now-24h"
216relativeTo = "now"
217
218[[rule.threat]]
219framework = "MITRE ATT&CK"
220
221[[rule.threat.technique]]
222id = "T1003"
223name = "OS Credential Dumping"
224reference = "https://attack.mitre.org/techniques/T1003/"
225
226[[rule.threat.technique.subtechnique]]
227id = "T1003.001"
228name = "LSASS Memory"
229reference = "https://attack.mitre.org/techniques/T1003/001/"
230
231[[rule.threat.technique]]
232id = "T1558"
233name = "Steal or Forge Kerberos Tickets"
234reference = "https://attack.mitre.org/techniques/T1558/"
235
236[rule.threat.tactic]
237id = "TA0006"
238name = "Credential Access"
239reference = "https://attack.mitre.org/tactics/TA0006/"
240
241[[rule.threat]]
242framework = "MITRE ATT&CK"
243
244[[rule.threat.technique]]
245id = "T1059"
246name = "Command and Scripting Interpreter"
247reference = "https://attack.mitre.org/techniques/T1059/"
248
249[[rule.threat.technique.subtechnique]]
250id = "T1059.001"
251name = "PowerShell"
252reference = "https://attack.mitre.org/techniques/T1059/001/"
253
254[[rule.threat.technique]]
255id = "T1106"
256name = "Native API"
257reference = "https://attack.mitre.org/techniques/T1106/"
258
259[rule.threat.tactic]
260id = "TA0002"
261name = "Execution"
262reference = "https://attack.mitre.org/tactics/TA0002/"