attack.t1558.003

The 'LsaRegisterLogonProcess' function verifies that the application making the function call is a logon process by checking that it has the SeTcbPrivilege privilege set. Possible Rubeus tries to get a handle to LSA.

Suspicious Kerberos RC4 Ticket Encryption

Oct 17, 2023 · attack.credential_access attack.t1558.003 ·

Share on:

Detects service ticket requests using RC4 encryption type

HackTool - Rubeus Execution - ScriptBlock

Jun 26, 2023 · attack.credential_access attack.t1003 attack.t1558.003 attack.lateral_movement attack.t1550.003 ·

Share on:

Detects the execution of the hacktool Rubeus using specific command line flags

Potential CVE-2021-42278 Exploitation Attempt

Jun 20, 2023 · attack.credential_access attack.t1558.003 cve.2021.42278 detection.emerging_threats ·

Share on:

The attacker creates a computer object using those permissions with a password known to her. After that she clears the attribute ServicePrincipalName on the computer object. Because she created the object (CREATOR OWNER), she gets granted additional permissions and can do many changes to the object.

Possible Impacket GetUserSPNs Activity

Apr 16, 2023 · attack.s0357 attack.credential_access attack.t1558 attack.t1558.003 ·

Share on:

Detects attempts to create vulnerable Kerberos Ticket Granting Service (TGS) tickets using the RC4-HMAC encryption type.

Potential CVE-2021-42287 Exploitation Attempt

Apr 14, 2023 · attack.credential_access attack.t1558.003 ·

Share on:

The attacker creates a computer object using those permissions with a password known to her. After that she clears the attribute ServicePrincipalName on the computer object. Because she created the object (CREATOR OWNER), she gets granted additional permissions and can do many changes to the object.

Request A Single Ticket via PowerShell

Jan 27, 2023 · attack.credential_access attack.t1558.003 ·

Share on:

utilize native PowerShell Identity modules to query the domain to extract the Service Principal Names for a single computer. This behavior is typically used during a kerberos or silver ticket attack. A successful execution will output the SPNs for the endpoint in question.

Kerberos Network Traffic RC4 Ticket Encryption

Oct 25, 2022 · attack.credential_access attack.t1558.003 ·

Share on:

Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting

Register new Logon Process by Rubeus

Oct 14, 2022 · attack.lateral_movement attack.privilege_escalation attack.t1558.003 ·

Share on:

Detects potential use of Rubeus via registered new trusted logon process