Detection rules › Kusto
Suspicious TGT Request with a DC Account
Below query detects TGT requests from a DC account with an IP that doesn't belong to a DC. It detect PetitPotam and any other attacks that uses a stolen DC certificate/account to perform operations.
If you make it a detection rule, take ingestion delay into account.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | No specific technique |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 4768: A Kerberos authentication ticket (TGT) was requested. |
Rule body
// Author : Cyb3rMonk(https://twitter.com/Cyb3rMonk, https://mergene.medium.com)
//
// Link to original post:
// https://posts.bluraven.io/detecting-petitpotam-and-other-domain-controller-account-takeovers-d3364bd9ee0a
//
// Description : This query detects if a computer account of a Domain Controller is stolen and used from a Non-DC device.
// computer account of a DC can bu used to obtain a TGT.
//
// Query parameters:
//
// list of DCs
let DCs = dynamic(["yourdc1.yourdomain.local"]);
// list of DC IPs
let DC_IPs = dynamic(["IP of the DCs including IPv6 addresses"]);
//
SecurityEvent
| where EventID == 4768
| where Computer in~ (DCs)
| where TargetUserName endswith "$"
| where DCs has replace_string(TargetUserName,"$","")
| where IpAddress <> "::1"
| extend IpAddress = replace_string(IpAddress, "::ffff:", "")
| where IpAddress !in (DC_IPs)
| project-reorder Computer, TargetUserName, IpAddress
Stages and Predicates
Parameters
let DCs = dynamic(["yourdc1.yourdomain.local"]);
let DC_IPs = dynamic(["IP of the DCs including IPv6 addresses"]);
Stage 1: source
SecurityEvent
Stage 2: where
| where EventID == 4768
Stage 3: where
| where Computer in~ (DCs)
Stage 4: where
| where TargetUserName endswith "$"
Stage 5: where
| where DCs has replace_string(TargetUserName,"$","")
Stage 6: where
| where IpAddress <> "::1"
Stage 7: extend
| extend IpAddress = replace_string(IpAddress, "::ffff:", "")
Stage 8: where
| where IpAddress !in (DC_IPs)
Stage 9: project-reorder
| project-reorder Computer, TargetUserName, IpAddress
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
IpAddress | eq | DC_IPs | excludes:IpAddress field:"IpAddress" value:"DC_IPs" |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Computer | in |
| field:"Computer" kind:in value:"DCs" |
EventID | eq |
| field:"EventID" kind:eq value:"4768" |
IpAddress | ne |
| field:"SourceIp" kind:ne value:"::1" |
TargetUserName | ends_with |
| field:"TargetUserName" kind:ends_with value:"$" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
IpAddress | extend |