Suspicious Kerberos Authentication Ticket Request

  1[metadata]
  2creation_date = "2025/10/28"
  3integration = ["endpoint", "windows", "system"]
  4maturity = "production"
  5updated_date = "2026/07/02"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Correlates network connections to the standard Kerberos port by an unusual process from the source machine with a
 11Kerberos authentication ticket request from the target domain controller.
 12"""
 13from = "now-9m"
 14index = [
 15    "logs-endpoint.events.network-*",
 16    "logs-windows.sysmon_operational-*",
 17    "logs-system.security*",
 18    "logs-windows.forwarded*",
 19    "winlogbeat-*"
 20]
 21language = "eql"
 22license = "Elastic License v2"
 23name = "Suspicious Kerberos Authentication Ticket Request"
 24references = [
 25"https://github.com/its-a-feature/bifrost", 
 26"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4768",
 27"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4769"
 28]
 29risk_score = 73
 30rule_id = "c6b40f4c-c6a9-434e-adb8-989b0d06d005"
 31severity = "high"
 32tags = [
 33    "Domain: Endpoint",
 34    "Domain: Identity",
 35    "OS: Windows",
 36    "Use Case: Threat Detection",
 37    "Tactic: Lateral Movement",
 38    "Use Case: Active Directory Monitoring",
 39    "Data Source: Active Directory",
 40    "Data Source: Elastic Defend",
 41    "Data Source: Sysmon",
 42    "Data Source: Windows Security Event Logs",
 43    "Resources: Investigation Guide",
 44]
 45timestamp_override = "event.ingested"
 46type = "eql"
 47
 48query = '''
 49sequence by source.port, source.ip with maxspan=3s
 50 [network where host.os.type == "windows" and destination.port == 88 and
 51  process.executable != null and process.pid != 4 and 
 52  not process.executable : (
 53        "?:\\Windows\\system32\\lsass.exe",
 54        "\\device\\harddiskvolume*\\windows\\system32\\lsass.exe",
 55        "\\device\\harddiskvolume*\\windows\\system32\\svchost.exe"
 56  ) and
 57  not (
 58    process.executable : (
 59      "C:\\Windows\\System32\\svchost.exe",
 60      "C:\\Program Files\\VMware\\VMware View\\Server\\bin\\ws_TomcatService.exe",
 61      "C:\\Program Files\\Omnissa\\Horizon\\Server\\bin\\ws_TomcatService.exe",
 62      "C:\\Program Files\\SysAidServer\\root\\WEB-INF\\domains\\NetworkDiscovery.exe",
 63      "C:\\Program Files (x86)\\IGEL\\RemoteManager\\*\\bin\\tomcat10.exe",
 64      "F:\\IGEL\\RemoteManager\\*\\bin\\tomcat10.exe"
 65    ) and
 66    user.id in ("S-1-5-20", "S-1-5-18")
 67  ) and
 68  source.ip != "127.0.0.1" and destination.ip != "::1" and destination.ip != "127.0.0.1"]
 69 [authentication where host.os.type == "windows" and event.code in ("4768", "4769")]
 70'''
 71
 72note = """## Triage and analysis
 73
 74### Investigating Suspicious Kerberos Authentication Ticket Request
 75
 76#### Possible investigation steps
 77
 78- Which Timeline member events define this Kerberos sequence?
 79  - Focus: Timeline members keyed by alert `source.ip` and `source.port`; recover source `process.executable`, Kerberos `destination.ip`, and auth `event.code`.
 80  - Hint: record `host.id` and `process.entity_id`; verify auth `winlog.computer_name` is the DC.
 81  - Implication: escalate when one non-"lsass.exe" source process maps to a DC "4768" or "4769" event in the sequence window; lower concern for socket reuse, a different process, or non-DC destination.
 82
 83- Is the recovered source process a recognized Kerberos-capable client?
 84  - Focus: `process.executable`, `process.hash.sha256`, `process.pe.original_file_name`, `process.code_signature.subject_name`, and `process.code_signature.trusted`.
 85  - Hint: open process start with recovered `host.id` and `process.entity_id`; if absent, use `host.id`, `process.pid`, and sequence window.
 86  - Implication: escalate when the binary is unsigned, renamed, user-writable, signer-mismatched, or outside known AD audit, Kerberos diagnostic, or security-test tooling; lower concern only when path, signer, hash history, command, and parent converge on one known tool.
 87
 88- Does command-line and parentage show ticket-tool intent?
 89  - Focus: recovered `process.command_line`, `process.parent.executable`, `process.parent.command_line`, and broader process lineage when needed.
 90  - Implication: escalate on Bifrost-like verbs or flags such as asktgt, asktgs, s4u, ptt, kerberoast, service/SPN targets, hashes, keytabs, RC4, or base64 tickets, especially from shell or script parents; bounded diagnostics from a recognized admin tool reduce but do not clear concern.
 91
 92- Which ticket path and target account did the DC member event show?
 93  - Focus: recovered auth `event.code`, `winlog.event_data.TargetUserName`, and `winlog.event_data.TargetDomainName`.
 94  - Implication: escalate when "4769" shows service-ticket activity or "4768" shows TGT handling for privileged, service, machine, or delegation-sensitive targets from the unusual process; fan-out increases concern.
 95
 96- Does the source user and session context fit one bounded admin or audit source?
 97  - Focus: recovered `user.id`, `user.name`, `user.domain`, and `winlog.event_data.TargetUserName`.
 98  - Implication: escalate when privileged, service, or user-account tickets originate from a workstation, user session, or non-management tool; lower concern only when source host, user, process identity, command/parent, and target account recur as one bounded Kerberos diagnostic or audit pattern.
 99
100- Do surrounding Kerberos events show repetition or account fan-out?
101  - Focus: same-source Kerberos network and authentication events, checking additional "4768"/"4769" events and `winlog.event_data.TargetUserName`.
102    - $investigate_0
103    - $investigate_1
104  - Implication: escalate when requests repeat or fan out across accounts; a single bounded request narrows scope but does not close if process identity or command intent remains suspicious. Missing network or authentication telemetry is unresolved, not benign.
105
106- Do later logon or explicit-credential events suggest ticket use?
107  - Focus: same-source authentication results, checking later `event.code` "4624"/"4648", `winlog.event_data.TargetUserName`, and 4648 `winlog.event_data.TargetServerName`.
108  - Implication: escalate when post-ticket logon or explicit-credential activity reaches sensitive accounts or servers from the same source; absence narrows impact but does not close if the ticket request remains suspicious. Missing same-source authentication telemetry leaves ticket use unresolved, not benign.
109
110- If local evidence remains suspicious or unresolved, does the same source show related alerts?
111  - Focus: related alerts for `source.ip`; manually pivot on recovered `process.hash.sha256` or `winlog.event_data.TargetUserName` when locally suspicious. $investigate_2
112  - Implication: broaden scope when credential-access, Kerberoasting, relay, or lateral-movement alerts share the source, process, or target account; keep local only when related alerts are absent and recovered evidence resolves cleanly.
113
114- Escalate when sequence recovery, source-process identity, command intent, DC ticket target, account context, or surrounding ticket/logon activity show unauthorized direct Kerberos; close only when telemetry binds one recognized tool, source host, user, and target account and outside confirmation verifies exact activity when telemetry cannot; preserve and escalate when visibility is incomplete or evidence conflicts.
115
116### False positive analysis
117
118- AD audit tools, Kerberos diagnostics, interoperability testing, or security testing can request tickets directly instead of through "lsass.exe". Confirm only when process path, signer/hash, parent, command line, `source.ip`, `user.id`, `event.code`, and target account align with the same recognized tool on a dedicated admin, lab, or audit source; without outside records, require the same process identity, source host/user, target account, and bounded ticket pattern across prior alerts from this rule.
119- Treat partial matches as unresolved when process identity fits but the command targets unusual SPNs, privileged accounts, RC4/kerberoast behavior, or follow-on "4624"/"4648" activity. Do not close on signer, source IP, or event code alone when ticket target or command intent contradicts benign workflow.
120- Before creating an exception, anchor it to the minimum stable workflow: dedicated `source.ip` or source host, process signer/hash/path, parent workflow, `user.id`, target account, and bounded `event.code` pattern. Avoid exceptions on `source.port`, `event.code`, process name, or broad account patterns alone.
121
122### Response and remediation
123
124- If confirmed benign, reverse temporary containment and document the recovered source host/IP, process identity, command line, source user, DC ticket event, and target account that proved the recognized workflow. Create an exception only after the same dedicated source and process pattern recurs consistently.
125- If suspicious but unconfirmed, preserve the alert, Timeline member events, suspicious process binary and command line, source socket, DC authentication record, and any follow-on "4624" or "4648" evidence before containment or process action.
126- Apply reversible containment next: restrict the recovered source host's Kerberos/DC access or isolate the host when its role tolerates isolation, and suspend the recovered process only after process and authentication artifacts are captured.
127- If confirmed malicious, isolate the recovered source host, terminate or suspend the recovered process after recording its `process.entity_id`, expire exposed Kerberos tickets where operationally appropriate, and reset or rotate impacted credentials, prioritizing privileged, service, machine, and delegation-capable accounts.
128- Before cleanup, search for the same source IP, recovered process hash, target account, and related credential-access, Kerberoasting, relay, or lateral-movement activity so scope is not limited to the first sequence.
129- After containment, retain DC "4768"/"4769" auditing and endpoint network telemetry, restrict direct Kerberos tooling to controlled admin/testing hosts, and document the recovered tool pattern and any logging gaps in the case record.
130"""
131
132setup = """## Setup
133
134This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
135
136Setup instructions: https://ela.st/install-elastic-defend
137
138### Additional data sources
139
140This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
141
142- [Sysmon Event ID 3 - Network Connection](https://ela.st/sysmon-event-3-setup)
143- [Audit Kerberos Authentication Service](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-kerberos-authentication-service)
144- [Audit Kerberos Service Ticket Operations](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-kerberos-service-ticket-operations)
145"""
146
147[rule.investigation_fields]
148field_names = [
149    "@timestamp",
150    "source.ip",
151    "source.port",
152    "host.id",
153]
154
155[transform]
156
157[[transform.investigate]]
158label = "Kerberos network events from the same source IP"
159description = ""
160providers = [
161  [
162    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" },
163    { excluded = false, field = "source.ip", queryType = "phrase", value = "{{source.ip}}", valueType = "string" },
164    { excluded = false, field = "destination.port", queryType = "phrase", value = "88", valueType = "string" }
165  ]
166]
167relativeFrom = "now-1h"
168relativeTo = "now"
169
170[[transform.investigate]]
171label = "Authentication events for the same source IP"
172description = ""
173providers = [
174  [
175    { excluded = false, field = "event.category", queryType = "phrase", value = "authentication", valueType = "string" },
176    { excluded = false, field = "source.ip", queryType = "phrase", value = "{{source.ip}}", valueType = "string" }
177  ]
178]
179relativeFrom = "now-1h"
180relativeTo = "now"
181
182[[transform.investigate]]
183label = "Alerts associated with the same source IP"
184description = ""
185providers = [
186  [
187    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
188    { excluded = false, field = "source.ip", queryType = "phrase", value = "{{source.ip}}", valueType = "string" }
189  ]
190]
191relativeFrom = "now-48h/h"
192relativeTo = "now"
193
194[[rule.threat]]
195framework = "MITRE ATT&CK"
196
197[[rule.threat.technique]]
198id = "T1550"
199name = "Use Alternate Authentication Material"
200reference = "https://attack.mitre.org/techniques/T1550/"
201
202[[rule.threat.technique.subtechnique]]
203id = "T1550.003"
204name = "Pass the Ticket"
205reference = "https://attack.mitre.org/techniques/T1550/003/"
206
207[rule.threat.tactic]
208id = "TA0008"
209name = "Lateral Movement"
210reference = "https://attack.mitre.org/tactics/TA0008/"
211
212[[rule.threat]]
213framework = "MITRE ATT&CK"
214
215[[rule.threat.technique]]
216id = "T1558"
217name = "Steal or Forge Kerberos Tickets"
218reference = "https://attack.mitre.org/techniques/T1558/"
219
220[[rule.threat.technique.subtechnique]]
221id = "T1558.003"
222name = "Kerberoasting"
223reference = "https://attack.mitre.org/techniques/T1558/003/"
224
225[[rule.threat.technique.subtechnique]]
226id = "T1558.004"
227name = "AS-REP Roasting"
228reference = "https://attack.mitre.org/techniques/T1558/004/"
229
230[rule.threat.tactic]
231id = "TA0006"
232name = "Credential Access"
233reference = "https://attack.mitre.org/tactics/TA0006/"