detection.wiki

Detection rules › Sigma

Rubeus Kerberos unconstrained delegation abuse

Status
experimental
Severity
high
Log source
product windows, service security
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker abuse Kerberos unconstrained delegation for domain persistence.

Known false positives

  • Accounts with unconstrained delegation enabled

MITRE ATT&CK coverage

TacticTechniques
Credential Access

Telemetry coverage

ProviderRecord / event type
Security-AuditingEvent ID 4769: A Kerberos service ticket was requested.

Rule body

title: Rubeus Kerberos unconstrained delegation abuse
description: Detects scenarios where an attacker abuse Kerberos unconstrained delegation for domain persistence.
references:
- https://dirkjanm.io/krbrelayx-unconstrained-delegation-abuse-toolkit/
- https://www.harmj0y.net/blog/activedirectory/s4u2pwnage/
- https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html
- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-kerberos-constrained-delegation
- https://www.guidepointsecurity.com/delegating-like-a-boss-abusing-kerberos-delegation-in-active-directory/
- https://stealthbits.com/blog/what-is-kerberos-delegation-an-overview-of-kerberos-delegation/
- https://www.thehacker.recipes/ad/movement/kerberos/delegations#talk
tags:
- attack.credential_access
- attack.t1558
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4769
    TransmittedServices|contains: '@'
    ServiceSid|endswith: '-502' # Krbtgt account SID
  filter:
    - TargetUserName: '%allowed_unconstrained_accounts%' # User accounts allowed to perform unconstrained delegation
    - IpAddress: '%domain_controllers_ips%'              # reduce amount of false positives
  condition: selection and not filter
falsepositives:
- Accounts with unconstrained delegation enabled
level: high

Stages and Predicates

Stage 0: condition

selection and not filter

Stage 1: selection

selection:
  EventID: 4769
  TransmittedServices|contains: '@'
  ServiceSid|endswith: '-502'

Stage 2: not filter

filter:
  - TargetUserName: '%allowed_unconstrained_accounts%'
  - IpAddress: '%domain_controllers_ips%'

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
IpAddresseq%domain_controllers_ips%excludes:IpAddress field:"IpAddress" value:"%domain_controllers_ips%"
TargetUserNameeq%allowed_unconstrained_accounts%excludes:TargetUserName field:"TargetUserName" value:"%allowed_unconstrained_accounts%"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
ServiceSidends_with
  • -502 corpus 4 (sigma 4)
field:"ServiceSid" kind:ends_with value:"-502"
TransmittedServicesmatch
  • @ corpus 2 (sigma 2)
field:"TransmittedServices" kind:match value:"@"