Detection rules › Splunk
Kerberos Weak Encryption Methods (Windows Event Log)
RC4 and DES encryption have known vulnerabilities and can be cracked by determined adversaries in a relatively short time. Their active use in a network puts credentials at risk
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access |
References
- https://docs.microsoft.com/en-us/archive/blogs/motiba/detecting-kerberoasting-activity-using-azure-security-center
- https://dirteam.com/sander/2014/07/15/security-thoughts-leveraging-ntlm-hashes-using-kerberos-rc4-hmac-encryption-aka-aorato-s-active-directory-vulnerability/
- https://tools.ietf.org/html/rfc6649
Telemetry coverage
Rule body
id: '1109.1180'
title: Kerberos Weak Encryption Methods
description: 'RC4 and DES encryption have known vulnerabilities and can be cracked
by determined adversaries in a relatively short time. Their active use in a network
puts credentials at risk. -- Threat Actor Association: FIN6, Muddled Libra, Wizard
Spider - Software Association: Conti, Ryuk'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4768) OR
"<EventID>4768<" OR TERM(EventCode=4769) OR "<EventID>4769<") AND ( TERM(0x17) OR
TERM(0x18) OR TERM(0x1) OR TERM(0x3) ) | regex "(i?)Ticket Encryption Type:\s+(0x17|0x18|0x1|0x3)"
| rename Logon_GUID as guid, Client_Address as client_ip, Client_Port as client_port,
Service_Name as user, Account_Domain as domain| rex field=_raw "Ticket Encryption
Type:\s+"(?<encryption_type>"0x\d+") | table _time, host, user action, client_ip,
client_port, domain, event_id, encryption_type, guid, service_name, signature_id,
user | bin span=1s | stats values(*) as * by _time, host, encryption_type '
techniques:
- credential-access:steal or forge kerberos tickets:kerberoasting
technique_id:
- T1558.003
data_category:
- Windows event logs
references:
- https://docs.microsoft.com/en-us/archive/blogs/motiba/detecting-kerberoasting-activity-using-azure-security-center
- https://dirteam.com/sander/2014/07/15/security-thoughts-leveraging-ntlm-hashes-using-kerberos-rc4-hmac-encryption-aka-aorato-s-active-directory-vulnerability/
- https://tools.ietf.org/html/rfc6649