detection.wiki

Detection rules › Splunk

Suspicious Ticket Granting Ticket Request

Status
production
Group by
RenamedComputerAccount
Author
Mauricio Velazco, Splunk
Source
github.com/splunk/security_content

The following analytic detects suspicious Kerberos Ticket Granting Ticket (TGT) requests that may indicate exploitation of CVE-2021-42278 and CVE-2021-42287. It leverages Event ID 4781 (account name change) and Event ID 4768 (TGT request) to identify sequences where a newly renamed computer account requests a TGT. This behavior is significant as it could represent an attempt to escalate privileges by impersonating a Domain Controller. If confirmed malicious, this activity could allow attackers to gain elevated access and potentially control over the domain environment.

MITRE ATT&CK coverage

TacticTechniques
Initial AccessT1078.002 Valid Accounts: Domain Accounts
PersistenceT1078.002 Valid Accounts: Domain Accounts
Privilege EscalationT1078.002 Valid Accounts: Domain Accounts
StealthT1078.002 Valid Accounts: Domain Accounts

Event coverage

ProviderEventTitle
Security-AuditingEvent ID 4768A Kerberos authentication ticket (TGT) was requested.
Security-AuditingEvent ID 4781The name of an account was changed.

Rule body splunk

name: Suspicious Ticket Granting Ticket Request
id: d77d349e-6269-11ec-9cfe-acde48001122
version: 10
creation_date: '2021-12-21'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Hunting
description: The following analytic detects suspicious Kerberos Ticket Granting Ticket (TGT) requests that may indicate exploitation of CVE-2021-42278 and CVE-2021-42287. It leverages Event ID 4781 (account name change) and Event ID 4768 (TGT request) to identify sequences where a newly renamed computer account requests a TGT. This behavior is significant as it could represent an attempt to escalate privileges by impersonating a Domain Controller. If confirmed malicious, this activity could allow attackers to gain elevated access and potentially control over the domain environment.
data_source:
    - Windows Event Log Security 4768
    - Windows Event Log Security 4781
search: |-
    `wineventlog_security` (EventCode=4781 OldTargetUserName="*$" NewTargetUserName!="*$") OR (EventCode=4768 TargetUserName!="*$")
      | eval RenamedComputerAccount = coalesce(NewTargetUserName, TargetUserName)
      | transaction RenamedComputerAccount startswith=(EventCode=4781) endswith=(EventCode=4768)
      | eval short_lived=case((duration<2),"TRUE")
      | search short_lived = TRUE
      | table _time, Computer, EventCode, TargetUserName, RenamedComputerAccount, short_lived
      | rename Computer as dest
      | `suspicious_ticket_granting_ticket_request_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
known_false_positives: A computer account name change event inmediately followed by a kerberos TGT request with matching fields is unsual. However, legitimate behavior may trigger it. Filter as needed.
references:
    - https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287
analytic_story:
    - sAMAccountName Spoofing and Domain Controller Impersonation
    - Active Directory Kerberos Attacks
    - Active Directory Privilege Escalation
asset_type: Endpoint
mitre_attack_id:
    - T1078.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/suspicious_ticket_granting_ticket_request/windows-xml.log
          source: XmlWinEventLog:Security
          sourcetype: XmlWinEventLog
      test_type: unit

Stages and Predicates

Stage 1: search

`wineventlog_security` (EventCode=4781 OldTargetUserName="*$" NewTargetUserName!="*$") OR (EventCode=4768 TargetUserName!="*$")

Stage 2: eval

| eval RenamedComputerAccount = coalesce(NewTargetUserName, TargetUserName)

Stage 3: transaction implicit 300s window

| transaction RenamedComputerAccount startswith=(EventCode=4781) endswith=(EventCode=4768)

Stage 4: eval

| eval short_lived=case((duration<2),"TRUE")
short_lived =
else"TRUE"

Stage 5: search

| search short_lived = TRUE

Stage 6: table

| table _time, Computer, EventCode, TargetUserName, RenamedComputerAccount, short_lived

Stage 7: rename

| rename Computer as dest

Stage 8: search

| `suspicious_ticket_granting_ticket_request_filter`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventCodeeq
  • 4768 corpus 13 (splunk 11, kusto 2)
  • 4781 corpus 2 (splunk 2)
NewTargetUserNamene
  • "*$" corpus 2 (splunk 2)
OldTargetUserNameeq
  • "*$" corpus 2 (splunk 2)
TargetUserNamene
  • "*$" corpus 14 (splunk 14)
short_livedeq
  • TRUE corpus 5 (splunk 5)