Potential Privilege Escalation via Local Kerberos Relay over LDAP

Status: test
Severity: high
Log source: product windows, service security
Author: Elastic, @SBousseaden
Source: github.com/SigmaHQ/sigma

Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account. This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges.

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1548` Abuse Elevation Control Mechanism

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4624: An account was successfully logged on.

Rule body

title: Potential Privilege Escalation via Local Kerberos Relay over LDAP
id: 749c9f5e-b353-4b90-a9c1-05243357ca4b
status: test
description: |
    Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account.
    This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges.
references:
    - https://twitter.com/sbousseaden/status/1518976397364056071?s=12&t=qKO5eKHvWhAP19a50FTZ7g
    - https://github.com/elastic/detection-rules/blob/5fe7833312031a4787e07893e27e4ea7a7665745/rules/_deprecated/privilege_escalation_krbrelayup_suspicious_logon.toml#L38
author: Elastic, @SBousseaden
date: 2022-04-27
modified: 2024-08-13
tags:
    - attack.privilege-escalation
    - attack.credential-access
    - attack.t1548
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4624
        LogonType: 3
        AuthenticationPackageName: 'Kerberos'
        IpAddress: '127.0.0.1'
        TargetUserSid|startswith: 'S-1-5-21-'
        TargetUserSid|endswith: '-500'
    filter_main_ip_null:
        IpPort: '0'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    EventID: 4624
    LogonType: 3
    AuthenticationPackageName: 'Kerberos'
    IpAddress: '127.0.0.1'
    TargetUserSid|startswith: 'S-1-5-21-'
    TargetUserSid|endswith: '-500'

Stage 2: `not filter_main_ip_null`

filter_main_ip_null:
    IpPort: '0'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`IpPort`	eq	`0`	`excludes:IpPort` `field:"IpPort" value:"0"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AuthenticationPackageName`	eq	`Kerberos` corpus 5 (sigma 2, elastic 2, splunk 1)	`field:"AuthenticationPackageName" kind:eq value:"Kerberos"`
`IpAddress`	eq	`127.0.0.1` corpus 6 (sigma 5, kusto 1)	`field:"src_ip" kind:eq value:"127.0.0.1"`
`LogonType`	eq	`3` corpus 41 (splunk 13, sigma 12, elastic 9, kusto 7)	`field:"LogonType" kind:eq value:"3"`
`TargetUserSid`	ends_with	`-500` corpus 2 (sigma 2)	`field:"TargetUserSid" kind:ends_with value:"-500"`
`TargetUserSid`	starts_with	`S-1-5-21-` corpus 3 (sigma 3)	`field:"TargetUserSid" kind:starts_with value:"S-1-5-21-"`