detection.wiki

Detection rules › Sigma

Potential Privilege Escalation via Local Kerberos Relay over LDAP

Status
test
Severity
high
Log source
product windows, service security
Author
Elastic, @SBousseaden
Source
github.com/SigmaHQ/sigma

Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account. This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges.

MITRE ATT&CK coverage

TacticTechniques
Privilege EscalationT1548 Abuse Elevation Control Mechanism

Event coverage

ProviderEventTitle
Security-AuditingEvent ID 4624An account was successfully logged on.

Rule body yaml

title: Potential Privilege Escalation via Local Kerberos Relay over LDAP
id: 749c9f5e-b353-4b90-a9c1-05243357ca4b
status: test
description: |
    Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account.
    This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges.
references:
    - https://twitter.com/sbousseaden/status/1518976397364056071?s=12&t=qKO5eKHvWhAP19a50FTZ7g
    - https://github.com/elastic/detection-rules/blob/5fe7833312031a4787e07893e27e4ea7a7665745/rules/_deprecated/privilege_escalation_krbrelayup_suspicious_logon.toml#L38
author: Elastic, @SBousseaden
date: 2022-04-27
modified: 2024-08-13
tags:
    - attack.privilege-escalation
    - attack.credential-access
    - attack.t1548
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4624
        LogonType: 3
        AuthenticationPackageName: 'Kerberos'
        IpAddress: '127.0.0.1'
        TargetUserSid|startswith: 'S-1-5-21-'
        TargetUserSid|endswith: '-500'
    filter_main_ip_null:
        IpPort: '0'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_main_*

Stage 1: selection

selection:
    EventID: 4624
    LogonType: 3
    AuthenticationPackageName: 'Kerberos'
    IpAddress: '127.0.0.1'
    TargetUserSid|startswith: 'S-1-5-21-'
    TargetUserSid|endswith: '-500'

Stage 2: not filter_main_ip_null

filter_main_ip_null:
    IpPort: '0'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
IpPorteq0

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
AuthenticationPackageNameeq
  • Kerberos corpus 5 (sigma 2, elastic 2, splunk 1)
IpAddresseq
  • 127.0.0.1 corpus 5 (sigma 4, kusto 1)
LogonTypeeq
  • 3 corpus 40 (splunk 13, sigma 12, elastic 9, kusto 6)
TargetUserSidends_with
  • -500 corpus 2 (sigma 2)
TargetUserSidstarts_with
  • S-1-5-21- corpus 3 (sigma 3)