Suspicious Kerberos Authentication Ticket Request

  1[metadata]
  2creation_date = "2025/10/28"
  3integration = ["endpoint", "windows", "system"]
  4maturity = "production"
  5updated_date = "2025/10/28"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Correlates network connections to the standard Kerberos port by an unusual process from the source machine with a Kerberos
 11authentication ticket request from the target domain controller.
 12"""
 13from = "now-9m"
 14index = [
 15    "logs-endpoint.events.network-*",
 16    "logs-windows.sysmon_operational-*",
 17    "logs-system.security*",
 18    "logs-windows.forwarded*",
 19    "winlogbeat-*"
 20]
 21language = "eql"
 22license = "Elastic License v2"
 23name = "Suspicious Kerberos Authentication Ticket Request"
 24note = """## Triage and analysis
 25
 26### Investigating Suspicious Kerberos Authentication Ticket Request
 27
 28Kerberos is the default authentication protocol in Active Directory, designed to provide strong authentication for client/server applications by using secret-key cryptography.
 29
 30Domain-joined hosts usually perform Kerberos traffic using the `lsass.exe` process. This rule detects the occurrence of traffic on the Kerberos port (88) by processes other than `lsass.exe` to detect the unusual request and usage of Kerberos tickets.
 31
 32#### Possible investigation steps
 33
 34- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 35- Investigate other alerts associated with the user/host during the past 48 hours.
 36- Check if the Destination IP is related to a Domain Controller.
 37- Review events ID 4769 and 4768 for suspicious ticket requests.
 38- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 39
 40### False positive analysis
 41
 42- Active Directory audit tools.
 43
 44### Response and remediation
 45
 46- Initiate the incident response process based on the outcome of the triage.
 47- Isolate the involved host to prevent further post-compromise behavior.
 48- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 49  - Ticket requests can be used to investigate potentially compromised accounts.
 50- If the triage identified malware, search the environment for additional compromised hosts.
 51  - Implement temporary network rules, procedures, and segmentation to contain the malware.
 52  - Stop suspicious processes.
 53  - Immediately block the identified indicators of compromise (IoCs).
 54  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
 55- Remove and block malicious artifacts identified during triage.
 56- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 57- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 58- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 59"""
 60references = [
 61"https://github.com/its-a-feature/bifrost", 
 62"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4768"
 63]
 64risk_score = 73
 65rule_id = "c6b40f4c-c6a9-434e-adb8-989b0d06d005"
 66severity = "high"
 67tags = [
 68    "Domain: Endpoint",
 69    "Domain: Identity",
 70    "OS: Windows",
 71    "Use Case: Threat Detection",
 72    "Tactic: Credential Access",
 73    "Tactic: Lateral Movement",
 74    "Use Case: Active Directory Monitoring",
 75    "Data Source: Active Directory",
 76    "Data Source: Elastic Defend",
 77    "Data Source: Sysmon",
 78    "Data Source: Windows Security Event Logs",
 79    "Resources: Investigation Guide",
 80]
 81timestamp_override = "event.ingested"
 82type = "eql"
 83
 84query = '''
 85sequence by source.port, source.ip with maxspan=3s
 86 [network where host.os.type == "windows" and destination.port == 88 and
 87  process.executable != null and
 88  not process.executable : ("?:\\Windows\\system32\\lsass.exe", "\\device\\harddiskvolume*\\windows\\system32\\lsass.exe") and
 89  source.ip != "127.0.0.1" and destination.ip != "::1" and destination.ip != "127.0.0.1"]
 90 [authentication where host.os.type == "windows" and event.code in ("4768", "4769")]
 91'''
 92
 93
 94[[rule.threat]]
 95framework = "MITRE ATT&CK"
 96[[rule.threat.technique]]
 97id = "T1550"
 98name = "Use Alternate Authentication Material"
 99reference = "https://attack.mitre.org/techniques/T1550/"
100[[rule.threat.technique.subtechnique]]
101id = "T1550.003"
102name = "Pass the Ticket"
103reference = "https://attack.mitre.org/techniques/T1550/003/"
104
105
106
107[rule.threat.tactic]
108id = "TA0008"
109name = "Lateral Movement"
110reference = "https://attack.mitre.org/tactics/TA0008/"
111[[rule.threat]]
112framework = "MITRE ATT&CK"
113[[rule.threat.technique]]
114id = "T1558"
115name = "Steal or Forge Kerberos Tickets"
116reference = "https://attack.mitre.org/techniques/T1558/"
117[[rule.threat.technique.subtechnique]]
118id = "T1558.003"
119name = "Kerberoasting"
120reference = "https://attack.mitre.org/techniques/T1558/003/"
121
122
123
124[rule.threat.tactic]
125id = "TA0006"
126name = "Credential Access"
127reference = "https://attack.mitre.org/tactics/TA0006/"