Suspicious Kerberos Enumeration via LDAP Search

[rule]
description = """
Identifies a list of common LDAP search queries used for Kerberoasting and AS-REP Roasting reconnaissance to identify
potential target accounts.
"""
id = "7367213e-05e3-41a9-b298-20ad8ba23aa6"
license = "Elastic License v2"
name = "Suspicious Kerberos Enumeration via LDAP Search"
os_list = ["windows"]
reference = ["https://attack.mitre.org/techniques/T1558/003/", "https://attack.mitre.org/techniques/T1558/004/"]
version = "1.0.3"

query = '''
api where process.Ext.api.name == "ldap_search" and user.id != "S-1-5-18" and
 not process.executable :
             ("?:\\Program Files\\Azure Advanced Threat Protection Sensor\\*\\Microsoft.Tri.Sensor.exe",
              "?:\\Windows\\ADFS\\Microsoft.IdentityServer.ServiceHost.exe",
              "?:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe") and
 process.Ext.api.parameters.search_filter : (
  // Kerberoasting SPN enumeration
  "(&(samAccountType=805306368)(servicePrincipalName=?))",
  "(&(samAccountType=805306368)(servicePrincipalName=?)(!samAccountName=krbtgt))",
  "(&(samAccountType=805306368)(servicePrincipalName=?)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))",
  "(&(samAccountType=805306368)(servicePrincipalName=?)(!samAccountName=krbtgt)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))",
  "(&(samAccountType=805306369)(servicePrincipalName=?))",
  "(&(objectCategory=user)(!(samAccountName=krbtgt)(servicePrincipalName=?)))",
  "(servicePrincipalName=?)",

  // Delegation-related SPN enumeration
  "(&(servicePrincipalName=?)(userAccountControl:1.2.840.113556.1.4.803:=524288))",     // Trusted for delegation
  "(&(userAccountControl:1.2.840.113556.1.4.803:=524288))", // Trusted for delegation
  "(&(servicePrincipalName=?)(userAccountControl:1.2.840.113556.1.4.803:=16777216))",  // Trusted to auth for delegation
  "(&(servicePrincipalName=?)(userAccountControl:1.2.840.113556.1.4.803:=1048576))",   // Account not delegated

  // AS-REP Roasting enumeration
  "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304))",
  "(&(samAccountType=805306368)(userAccountControl:1.2.840.113556.1.4.803:=4194304))"
 )
'''

min_endpoint_version = "9.1.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1087"
name = "Account Discovery"
reference = "https://attack.mitre.org/techniques/T1087/"
[[threat.technique.subtechnique]]
id = "T1087.002"
name = "Domain Account"
reference = "https://attack.mitre.org/techniques/T1087/002/"


[[threat.technique]]
id = "T1482"
name = "Domain Trust Discovery"
reference = "https://attack.mitre.org/techniques/T1482/"


[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[internal]
min_endpoint_version = "9.1.0"