Potential Kerberos Attack via Bifrost

[rule]
description = """
Identifies use of Bifrost, a known macOS Kerberos pentesting tool, which can be used to dump cached Kerberos tickets or
attempt unauthorized authentication techniques such as pass-the-ticket/hash and kerberoasting.
"""
id = "fecebe4f-2d28-46e7-9bc1-71cdd8ecdd60"
license = "Elastic License v2"
name = "Potential Kerberos Attack via Bifrost"
os_list = ["macos"]
reference = ["https://github.com/its-a-feature/bifrost"]
version = "1.0.28"

query = '''
process where event.type == "start" and process.args like~ "-action" and
 (
  process.args like~ ("-kerberoast", "askhash", "asktgs", "asktgt", "s4u") or
  (process.args like~ "-ticket" and process.args like~ "ptt") or
  (process.args like~ "dump" and process.args in~ ("tickets", "keytab"))
  )
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1558"
name = "Steal or Forge Kerberos Tickets"
reference = "https://attack.mitre.org/techniques/T1558/"
[[threat.technique.subtechnique]]
id = "T1558.003"
name = "Kerberoasting"
reference = "https://attack.mitre.org/techniques/T1558/003/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1550"
name = "Use Alternate Authentication Material"
reference = "https://attack.mitre.org/techniques/T1550/"
[[threat.technique.subtechnique]]
id = "T1550.003"
name = "Pass the Ticket"
reference = "https://attack.mitre.org/techniques/T1550/003/"



[threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[internal]
min_endpoint_version = "8.10.2"