Detection rules › Splunk
Unusual Number of Computer Service Tickets Requested
The following analytic identifies an unusual number of computer service ticket requests from a single source, leveraging Event ID 4769, "A Kerberos service ticket was requested." It uses statistical analysis, including standard deviation and the 3-sigma rule, to detect anomalies in service ticket requests. This activity is significant as it may indicate malicious behavior such as lateral movement, malware staging, or reconnaissance. If confirmed malicious, an attacker could gain unauthorized access to multiple endpoints, facilitating further compromise and potential data exfiltration.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1078 Valid Accounts |
| Persistence | T1078 Valid Accounts |
| Privilege Escalation | T1078 Valid Accounts |
| Stealth | T1078 Valid Accounts |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4769 | A Kerberos service ticket was requested. |
Rule body splunk
name: Unusual Number of Computer Service Tickets Requested
id: ac3b81c0-52f4-11ec-ac44-acde48001122
version: 9
creation_date: '2021-12-03'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: experimental
type: Hunting
description: The following analytic identifies an unusual number of computer service ticket requests from a single source, leveraging Event ID 4769, "A Kerberos service ticket was requested." It uses statistical analysis, including standard deviation and the 3-sigma rule, to detect anomalies in service ticket requests. This activity is significant as it may indicate malicious behavior such as lateral movement, malware staging, or reconnaissance. If confirmed malicious, an attacker could gain unauthorized access to multiple endpoints, facilitating further compromise and potential data exfiltration.
data_source:
- Windows Event Log Security 4769
search: |-
`wineventlog_security` EventCode=4769 Service_Name="*$" Account_Name!="*$*"
| bucket span=2m _time
| stats dc(Service_Name) AS unique_targets values(Service_Name) as host_targets
BY _time, Client_Address, Account_Name
| eventstats avg(unique_targets) as comp_avg , stdev(unique_targets) as comp_std
BY Client_Address, Account_Name
| eval upperBound=(comp_avg+comp_std*3)
| eval isOutlier=if(unique_targets >10 and unique_targets >= upperBound, 1, 0)
| `unusual_number_of_computer_service_tickets_requested_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
known_false_positives: An single endpoint requesting a large number of computer service tickets is not common behavior. Possible false positive scenarios include but are not limited to vulnerability scanners, administration systeams and missconfigured systems.
references:
- https://attack.mitre.org/techniques/T1078/
analytic_story:
- Active Directory Lateral Movement
- Active Directory Kerberos Attacks
- Active Directory Privilege Escalation
- Scattered Lapsus$ Hunters
asset_type: Endpoint
mitre_attack_id:
- T1078
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
category: endpoint
security_domain: endpoint
Stages and Predicates
Stage 1: search
`wineventlog_security` EventCode=4769 Service_Name="*$" Account_Name!="*$*"
Stage 2: bucket
| bucket span=2m _time
Stage 3: stats
| stats dc(Service_Name) AS unique_targets values(Service_Name) as host_targets
BY _time, Client_Address, Account_Name
Stage 4: eventstats
| eventstats avg(unique_targets) as comp_avg , stdev(unique_targets) as comp_std
BY Client_Address, Account_Name
Stage 5: eval
| eval upperBound=(comp_avg+comp_std*3)
Stage 6: eval
| eval isOutlier=if(unique_targets >10 and unique_targets >= upperBound, 1, 0)
isOutlier =unique_targets > 10 AND unique_targets >= upperBound10Stage 7: search
| `unusual_number_of_computer_service_tickets_requested_filter`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Account_Name | ne |
|
EventCode | eq |
|
Service_Name | eq |
|