Potential SPN Enumeration Via Setspn.EXE

Title: Potential SPN Enumeration Via Setspn.EXE
Status: test
Description:Detects service principal name (SPN) enumeration used for Kerberoasting
References:
  -https://web.archive.org/web/20200329173843/https://p16.praetorian.com/blog/how-to-use-kerberoasting-t1208-for-privilege-escalation
  -https://www.praetorian.com/blog/how-to-use-kerberoasting-t1208-for-privilege-escalation/?edition=2019
Author: Markus Neis, keepwatch
Date: 2018-11-14
modified:2023-10-23
Tags:

• -'attack.credential-access'
• -'attack.t1558.003'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_pe:
Image|endswith:'\setspn.exe' OriginalFileName:'setspn.exe'     - Description|contains|all:
      - 'Query or reset the computer'
      - 'SPN attribute'
  selection_cli:
    CommandLine|contains:
      -' -q '
      -' /q '

  condition:all of selection_*
Falsepositives:
  -Administration activity
Level: medium