detection.wiki

Detection rules › Sigma

Brutforce enumeration with unexisting users (Kerberos)

Status
experimental
Severity
high
Time window
30m
Log source
product windows, service security
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to enumerate potential existing users, resulting in failed Kerberos TGT requests with unexisting or invalid accounts.

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1110 Brute Force

Event coverage

ProviderEventTitle
Security-AuditingEvent ID 4768A Kerberos authentication ticket (TGT) was requested.
Security-AuditingEvent ID 4771Kerberos pre-authentication failed.

Rule body yaml

title: Brutforce enumeration with unexisting users (Kerberos)
name: bruteforce_non_existing_users_kerberos
description: Detects scenarios where an attacker attempts to enumerate potential existing users, resulting in failed Kerberos TGT requests with unexisting or invalid accounts.
references:
  - https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1110.xxx-Brut%20force
  - https://github.com/ropnop/kerbrute
tags:
  - attack.credential_access
  - attack.t1110
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 4771
      - 4768
    Status: "0x6" # KDC_ERR_C_PRINCIPAL_UNKNOWN
  filter:
    - IpAddress: "%domain_controllers_ips%" # reduce amount of false positives
    - TicketOptions: 0x50800000 # covered by Kerbrute rule
  condition: selection and not filter
falsepositives:
  - Missconfigured application or identity services
level: high

---
title: Brutforce enumeration with unexisting users (Kerberos) Count
status: experimental
correlation:
  type: value_count
  rules:
    - bruteforce_non_existing_users_kerberos # Referenced here
  group-by:
    - Computer
  timespan: 30m
  condition:
    gte: 20
    field: TargetUserName # Count how many failed logins with non existing users were reported on the domain controller.
level: high

Stages and Predicates

Stage 0: condition

selection and not filter

Stage 1: selection

selection:
  EventID:
    - 4771
    - 4768
  Status: "0x6"

Stage 2: not filter

filter:
  - IpAddress: "%domain_controllers_ips%"
  - TicketOptions: 0x50800000

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
IpAddresseq%domain_controllers_ips%
TicketOptionseq1350565888

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Statuseq
  • 0x6 corpus 5 (splunk 3, sigma 2)