Possible Impacket GetUserSPNs Activity

calendar Apr 16, 2023 · attack.s0357 attack.credential_access attack.t1558 attack.t1558.003  ·
Share on: linkedin copy

Detects attempts to create vulnerable Kerberos Ticket Granting Service (TGS) tickets using the RC4-HMAC encryption type.

Sigma rule (View on GitHub)

 1title: Possible Impacket GetUserSPNs Activity
 2id: 73822599-97d8-411f-8ee1-e57ecac118c7
 3status: experimental
 4description: Detects attempts to create vulnerable Kerberos Ticket Granting Service (TGS) tickets using the RC4-HMAC encryption type.
 5references:
 6    - https://www.blackhillsinfosec.com/impacket-defense-basics-with-an-azure-lab/
 7    - https://github.com/fortra/impacket/blob/impacket_0_10_0/examples/GetUserSPNs.py
 8author: Micah Babinski
 9date: 2023/04/13
10tags:
11    - attack.s0357
12    - attack.credential_access
13    - attack.t1558
14    - attack.t1558.003
15logsource:
16    product: zeek
17    service: kerberos
18detection:
19    selection:
20        cipher: 'rc4-hmac'
21        request_type: 'TGS'
22        success: true
23    condition: selection
24fields:
25    - id.orig_h
26    - client
27    - service
28falsepositives:
29    - Unknown
30level: low```

References

Related rules

to-top