Title:
Uncommon Outbound Kerberos Connection - Security
Status:
test
Description:Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.
References:
-https://github.com/GhostPack/Rubeus
Author: Ilyas Ochkov, oscd.community
Date: 2019-10-24
modified:2024-03-15
Tags:
- -'attack.lateral-movement'
- -'attack.credential-access'
- -'attack.t1558.003'
Logsource:
- product: windows
- service: security
Detection:
selection:
EventID:
'5156'
DestPort:
'88'
filter_main_lsass:
Application|startswith:
-'\device\harddiskvolume'
-'C:'
Application|endswith:
'\Windows\System32\lsass.exe'
filter_optional_chrome:
Application|startswith:
-'\device\harddiskvolume'
-'C:'
Application|endswith:
-'\Program Files (x86)\Google\Chrome\Application\chrome.exe'
-'\Program Files\Google\Chrome\Application\chrome.exe'
filter_optional_firefox:
Application|startswith:
-'\device\harddiskvolume'
-'C:'
Application|endswith:
-'\Program Files (x86)\Mozilla Firefox\firefox.exe'
-'\Program Files\Mozilla Firefox\firefox.exe'
filter_optional_tomcat:
Application|endswith:
'\tomcat\bin\tomcat8.exe'
condition:
selection and not 1 of filter_main_* and not 1 of filter_optional_*
Falsepositives:
-Web Browsers and third party application might generate similar activity. An initial baseline is required.
Level:
medium
