Suspicious Credential Files Creation via Kerberos

[rule]
description = """
Identifies network connections to the standard Kerberos or SMB ports from an unusual process followed by the creation of
a sensitive file such as kerberos ticket and certificate keys. On Windows, the only native system process that normally
performs Kerberos traffic from a domain joined host is lsass.exe and SMB is the System virtual process. This may
indicate an ongoing Kerberos attack.
"""
id = "ced93ac0-f153-402f-9239-17ae32f304e2"
license = "Elastic License v2"
name = "Suspicious Credential Files Creation via Kerberos"
os_list = ["windows"]
reference = [
    "https://research.ifcr.dk/certipy-2-0-bloodhound-new-escalations-shadow-credentials-golden-certificates-and-more-34d1c26f0dc6",
    "https://posts.specterops.io/certified-pre-owned-d95910965cd2",
]
version = "1.0.30"

query = '''
sequence by process.entity_id with maxspan=1m

 [network where
   destination.port in (88, 445) and source.port >= 49152 and
   network.direction == "egress" and network.transport == "tcp" and
   process.pid != 4 and
   not process.executable :
              ("?:\\Windows\\System32\\lsass.exe",
               "\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
               "?:\\Program Files (x86)\\*.exe",
               "?:\\Program Files\\*.exe")]

 [file where event.action in ("creation", "overwrite") and

   /* dumping PFX, CCACHE or KIRBI via kerberos */
   (file.extension in~ ("ccache", "pfx", "kirbi") or file.Ext.header_bytes : ("0504*", "3082*", "768*")) and
   not (process.name : "powershell.exe" and file.path : "?:\\Windows\\ServiceProfiles\\LocalService\\AppData\\*") and
   not (process.code_signature.trusted == true and process.code_signature.subject_name in ("KASEYA US LLC", "The Apache Software Foundation")) and
   not file.path like "C:\\Users\\*\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*"]
'''

min_endpoint_version = "8.0.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1558"
name = "Steal or Forge Kerberos Tickets"
reference = "https://attack.mitre.org/techniques/T1558/"


[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1021"
name = "Remote Services"
reference = "https://attack.mitre.org/techniques/T1021/"
[[threat.technique.subtechnique]]
id = "T1021.002"
name = "SMB/Windows Admin Shares"
reference = "https://attack.mitre.org/techniques/T1021/002/"



[threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[internal]
min_endpoint_version = "8.0.0"