Windows Computer Account Requesting Kerberos Ticket

name: Windows Computer Account Requesting Kerberos Ticket
id: fb3b2bb3-75a4-4279-848a-165b42624770
version: 10
creation_date: '2022-04-28'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects a computer account requesting a Kerberos ticket, which is unusual as typically user accounts request these tickets. This detection leverages Windows Security Event Logs, specifically EventCode 4768, to identify instances where the TargetUserName ends with a dollar sign ($), indicating a computer account. This activity is significant because it may indicate the use of tools like KrbUpRelay or other Kerberos-based attacks. If confirmed malicious, this could allow attackers to impersonate computer accounts, potentially leading to unauthorized access and lateral movement within the network.
data_source:
    - Windows Event Log Security 4768
search: |-
    `wineventlog_security`  EventCode=4768 TargetUserName="*$"  src_ip!="::1"
      | stats  count min(_time) as firstTime max(_time) as lastTime
        BY dest, subject, action,
           user, TargetUserName, src_ip
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_computer_account_requesting_kerberos_ticket_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4768 EventCode enabled. The Windows TA is also required.
known_false_positives: It is possible false positives will be present based on third party applications. Filtering may be needed.
references:
    - https://github.com/Dec0ne/KrbRelayUp
finding:
    title: A Computer Account requested a Kerberos ticket on $dest$, possibly indicative of Kerberos relay attack.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Active Directory Kerberos Attacks
    - Local Privilege Escalation With KrbRelayUp
asset_type: Endpoint
mitre_attack_id:
    - T1558
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint