Detection rules › Elastic
LDAP Search followed by Kerberos Connection
Identifies Ldap search followed by a network connections to the standard Kerberos port from an unusual process. On Windows, the only native system process that normally performs Kerberos traffic from a domain joined host is lsass.exe.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access |
Rule body
[rule]
description = """
Identifies Ldap search followed by a network connections to the standard Kerberos port from an unusual process. On
Windows, the only native system process that normally performs Kerberos traffic from a domain joined host is lsass.exe.
"""
id = "53e680ea-89b7-474a-ac10-089adcd02f13"
license = "Elastic License v2"
name = "LDAP Search followed by Kerberos Connection"
os_list = ["windows"]
version = "1.0.1"
query = '''
sequence by process.entity_id with maxspan=1m
[api where process.Ext.api.name == "ldap_search" and
not (user.id == "S-1-5-18" and process.executable : "?:\\Windows\\System32\\lsass.exe") and
not (process.executable : "C:\\Program Files\\*\\Server\\bin\\ws_TomcatService.exe" and
process.code_signature.subject_name in ("VMware, Inc.", "Omnissa, LLC") and process.code_signature.trusted == true) and
not (process.executable : "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" and
process.parent.executable : "C:\\Windows\\System32\\svchost.exe" and process.Ext.api.parameters.search_filter in ("(cn=rid manager$)", "(cn=krbtgt)")) and
not (process.executable : "C:\\Program Files\\Microsoft Office\\root\\Office16\\WINWORD.EXE" and process.Ext.api.parameters.search_filter like "(|(mail=*)(proxyAddresses=smtp:*))")
]
[network where destination.port == 88 and source.port >= 49152 and network.direction == "egress" and
network.transport == "tcp" and not destination.address : ("127.*", "::1")]
'''
min_endpoint_version = "9.1.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1558"
name = "Steal or Forge Kerberos Tickets"
reference = "https://attack.mitre.org/techniques/T1558/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "9.1.0"
Stages and Predicates
Ordered sequence: each step below must occur in order within 1m, correlated by process.entity_id.
Stage 1: api
[api where process.Ext.api.name == "ldap_search" and
not (user.id == "S-1-5-18" and process.executable : "?:\\Windows\\System32\\lsass.exe") and
not (process.executable : "C:\\Program Files\\*\\Server\\bin\\ws_TomcatService.exe" and
process.code_signature.subject_name in ("VMware, Inc.", "Omnissa, LLC") and process.code_signature.trusted == true) and
not (process.executable : "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" and
process.parent.executable : "C:\\Windows\\System32\\svchost.exe" and process.Ext.api.parameters.search_filter in ("(cn=rid manager$)", "(cn=krbtgt)")) and
not (process.executable : "C:\\Program Files\\Microsoft Office\\root\\Office16\\WINWORD.EXE" and process.Ext.api.parameters.search_filter like "(|(mail=*)(proxyAddresses=smtp:*))")
]
Stage 2: network
[network where destination.port == 88 and source.port >= 49152 and network.direction == "egress" and
network.transport == "tcp" and not destination.address : ("127.*", "::1")]
Exclusions
The rule actively suppresses these predicates.
Indicators
These rows show field, operator, and value matches.