Uncommon Outbound Kerberos Connection

Status: test
Severity: medium
Log source: category network_connection, product windows
Author: Ilyas Ochkov, oscd.community
Source: github.com/SigmaHQ/sigma

Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.

Known false positives

Web Browsers and third party application might generate similar activity. An initial baseline is required.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1558` Steal or Forge Kerberos Tickets
Lateral Movement	`T1550.003` Use Alternate Authentication Material: Pass the Ticket

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 3: Network connection

Rule body

title: Uncommon Outbound Kerberos Connection
id: e54979bd-c5f9-4d6c-967b-a04b19ac4c74
related:
    - id: eca91c7c-9214-47b9-b4c5-cb1d7e4f2350
      type: similar
status: test
description: |
    Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.
references:
    - https://github.com/GhostPack/Rubeus
author: Ilyas Ochkov, oscd.community
date: 2019-10-24
modified: 2024-03-15
tags:
    - attack.credential-access
    - attack.t1558
    - attack.lateral-movement
    - attack.t1550.003
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort: 88
        Initiated: 'true'
    filter_main_lsass:
        Image: 'C:\Windows\System32\lsass.exe'
    filter_optional_chrome:
        Image:
            - 'C:\Program Files (x86)\Google\Chrome\Application\chrome.exe'
            - 'C:\Program Files\Google\Chrome\Application\chrome.exe'
    filter_optional_firefox:
        Image:
            - 'C:\Program Files (x86)\Mozilla Firefox\firefox.exe'
            - 'C:\Program Files\Mozilla Firefox\firefox.exe'
    filter_optional_tomcat:
        Image|endswith: '\tomcat\bin\tomcat8.exe'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Web Browsers and third party application might generate similar activity. An initial baseline is required.
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_* and not 1 of filter_optional_*

Stage 1: `selection`

selection:
    DestinationPort: 88
    Initiated: 'true'

Stage 2: `not filter_main_lsass`

filter_main_lsass:
    Image: 'C:\Windows\System32\lsass.exe'

Stage 3: `not filter_optional_*`

filter_optional_chrome:
    Image:
        - 'C:\Program Files (x86)\Google\Chrome\Application\chrome.exe'
        - 'C:\Program Files\Google\Chrome\Application\chrome.exe'
filter_optional_firefox:
    Image:
        - 'C:\Program Files (x86)\Mozilla Firefox\firefox.exe'
        - 'C:\Program Files\Mozilla Firefox\firefox.exe'
filter_optional_tomcat:
    Image|endswith: '\tomcat\bin\tomcat8.exe'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	eq	`C:\Windows\System32\lsass.exe`	`excludes:Image` `field:"Image" value:"C:\Windows\System32\lsass.exe"`
`Image`	ends_with	`\tomcat\bin\tomcat8.exe`	`excludes:Image` `field:"Image" value:"\tomcat\bin\tomcat8.exe"`
`Image`	eq	`C:\Program Files (x86)\Google\Chrome\Application\chrome.exe`	`excludes:Image` `field:"Image" value:"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"`
`Image`	eq	`C:\Program Files (x86)\Mozilla Firefox\firefox.exe`	`excludes:Image` `field:"Image" value:"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"`
`Image`	eq	`C:\Program Files\Google\Chrome\Application\chrome.exe`	`excludes:Image` `field:"Image" value:"C:\Program Files\Google\Chrome\Application\chrome.exe"`
`Image`	eq	`C:\Program Files\Mozilla Firefox\firefox.exe`	`excludes:Image` `field:"Image" value:"C:\Program Files\Mozilla Firefox\firefox.exe"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`DestinationPort`	eq	`88` corpus 7 (elastic 4, sigma 2, splunk 1)	`field:"DestinationPort" kind:eq value:"88"`
`Initiated`	eq	`true` corpus 50 (sigma 50)	`field:"Initiated" kind:eq value:"true"`