Suspicious SPN enumeration previous to Kerberoasting attack (PowerShell)

title: Suspicious SPN enumeration previous to Kerberoasting attack (PowerShell)
description: Detects scenarios where an attacker attempts to retrieve SPN using PowerShell and native tools.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0007-Discovery/T1087-Account%20discovery
- https://github.com/nidem/kerberoast
- https://github.com/cyberark/RiskySPN
- https://pentestlab.blog/2018/06/04/spn-discovery/
- https://adsecurity.org/?p=3458
- https://redcanary.com/blog/marshmallows-and-kerberoasting/
- https://www.security.com/threat-intelligence/us-china-espionage
tags:
- attack.account_discovery
- attack.t1087.002
- attack.credential_access
- attack.t1558.003
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category:
    - ps_module
    - ps_classic_script
    - ps_script
detection:
  selection1_powershell_native:
    EventID: 800
    EventData|contains:
      - 'System.IdentityModel.Tokens.KerberosRequestorSecurityToken'
      - 'Add-Type -AssemblyName System.IdentityModel'

  selection2_powershell_modern:
    EventID: 4103
    Payload|contains:
      - 'System.IdentityModel.Tokens.KerberosRequestorSecurityToken'
      - 'Add-Type -AssemblyName System.IdentityModel'

  selection3_powershell_block:
    EventID: 4104
    ScriptBlockText|contains:
      - 'System.IdentityModel.Tokens.KerberosRequestorSecurityToken'
      - 'Add-Type -AssemblyName System.IdentityModel'

  condition: 1 of selection*
falsepositives:
- Administrators
level: high