Detection rules › Sigma
Kerberos Network Traffic RC4 Ticket Encryption
Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting
Known false positives
- Normal enterprise SPN requests activity
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access |
Rule body
title: Kerberos Network Traffic RC4 Ticket Encryption
id: 503fe26e-b5f2-4944-a126-eab405cc06e5
status: test
description: Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting
references:
- https://adsecurity.org/?p=3458
author: sigma
date: 2020-02-12
modified: 2021-11-27
tags:
- attack.credential-access
- attack.t1558.003
logsource:
product: zeek
service: kerberos
detection:
selection:
request_type: 'TGS'
cipher: 'rc4-hmac'
computer_acct:
service|startswith: '$'
condition: selection and not computer_acct
falsepositives:
- Normal enterprise SPN requests activity
level: medium
Stages and Predicates
Stage 0: condition
selection and not computer_acctStage 1: selection
selection:
request_type: 'TGS'
cipher: 'rc4-hmac'
Stage 2: not computer_acct
computer_acct:
service|startswith: '$'
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
service | starts_with | $ | excludes:service field:"service" value:"$" |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
cipher | eq |
| field:"cipher" kind:eq value:"rc4-hmac" |
request_type | eq |
| field:"request_type" kind:eq value:"TGS" |