Kerberos enumeration with existing/unexisting users (Kerbrute)

title: Kerberos enumeration with existing/unexisting users (Kerbrute)
name: kerbrute_enumeration
description: Detects scenarios where an attacker attempts to enumerate existing or non existing users using "Kerbrute". This use case can also be related to spot vulnearbility "MS14-068".
references:
  - https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1110.xxx-Brut%20force
  - https://github.com/ropnop/kerbrute
  - https://www.jpcert.or.jp/english/pub/sr/20170612ac-ir_research_en.pdf
tags:
  - attack.credential_access
  - attack.t1110
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 4771
      - 4768
    Status: "0x6" # KDC_ERR_C_PRINCIPAL_UNKNOWN
    TicketOptions: 0x50800000
  filter:
    - IpAddress: "%domain_controllers_ips%" # reduce amount of false positives
    - TargetUserName: "%account_allowed_proxy%" # accounts allowed to perform proxiable requests
  condition: selection and not filter
falsepositives:
  - Missconfigured application or identity services
level: high

---
title: Kerberos enumeration with existing/unexisting users (Kerbrute) Count
status: experimental
correlation:
  type: value_count
  rules:
    - kerbrute_enumeration # Referenced here
  group-by:
    - Computer
  timespan: 30m
  condition:
    gte: 20
    field: TargetUserName # Count how many failed logins were reported on the domain controller.
level: high