Detection rules › Elastic
Kerberos Config File Accessed by Untrusted or Unsigned Process
Identifies an untrusted or unsigned process accessing the Kerberos configuration file. Adversaries may attempt to access this file in order to gain situational awareness regarding the Active Directory domain to include its structure and settings.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access |
Telemetry coverage
| Platform | Record / event type |
|---|---|
| macOS | ESF event open (NOTIFY): Fires after the kernel grants a process access to open a file. |
Rule body
[rule]
description = """
Identifies an untrusted or unsigned process accessing the Kerberos configuration file. Adversaries may attempt to access
this file in order to gain situational awareness regarding the Active Directory domain to include its structure and
settings.
"""
id = "143a7c98-62d3-4294-b660-6a98ae0a477c"
license = "Elastic License v2"
name = "Kerberos Config File Accessed by Untrusted or Unsigned Process"
os_list = ["macos"]
version = "1.0.5"
query = '''
file where event.action == "open" and
file.path like "/etc/krb5.conf" and
(process.code_signature.trusted == false or process.code_signature.exists == false)
'''
min_endpoint_version = "8.11.1"
optional_actions = []
[[actions]]
action = "kill_process"
field = "Effective_process.executable"
state = 0
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1649"
name = "Steal or Forge Authentication Certificates"
reference = "https://attack.mitre.org/techniques/T1649/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "8.11.1"
Stages and Predicates
Stage 1: file
file where event.action == "open" and
file.path like "/etc/krb5.conf" and
(process.code_signature.trusted == false or process.code_signature.exists == false)
Indicators
These rows show field, operator, and value matches.