Name:Kerberos TGT Request Using RC4 Encryption id:18916468-9c04-11ec-bdc6-acde48001122 version:5 date:2024-09-30 author:Mauricio Velazco, Splunk status:production type:TTP Description:The following analytic detects a Kerberos Ticket Granting Ticket (TGT) request using RC4-HMAC encryption (type 0x17) by leveraging Event 4768. This encryption type is outdated and its presence may indicate an OverPass The Hash attack. Monitoring this activity is crucial as it can signify credential theft, allowing adversaries to authenticate to the Kerberos Distribution Center (KDC) using a stolen NTLM hash. If confirmed malicious, this could enable unauthorized access to systems and resources, potentially leading to lateral movement and further compromise within the network. Data_source:
-Windows Event Log Security 4768
search:`wineventlog_security` EventCode=4768 TicketEncryptionType=0x17 ServiceName!=*$ | stats count min(_time) as firstTime max(_time) as lastTime by ServiceName src_ip dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kerberos_tgt_request_using_rc4_encryption_filter`
how_to_implement:To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. known_false_positives:Based on Microsoft documentation, legacy systems or applications will use RC4-HMAC as the default encryption for TGT requests. Specifically, systems before Windows Server 2008 and Windows Vista. Newer systems will use AES128 or AES256. References: -https://stealthbits.com/blog/how-to-detect-overpass-the-hash-attacks/ -https://www.thehacker.recipes/ad/movement/kerberos/ptk -https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4768 drilldown_searches: name:'View the detection results for - "$src_ip$"' search:'%original_detection_search% | search src_ip = "$src_ip$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$src_ip$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' tags: analytic_story: - 'Active Directory Kerberos Attacks' asset_type:Endpoint confidence:50 impact:50 message:A Kerberos TGT request with RC4 encryption was requested for $ServiceName$ from $src_ip$ mitre_attack_id: - 'T1550' observable: name:'src_ip' type:'Endpoint' - role: - 'Victim' product: - 'Splunk Enterprise' - 'Splunk Enterprise Security' - 'Splunk Cloud' required_fields: - '_time' - 'EventCode' - 'TicketEncryptionType' - 'ServiceName' risk_score:25 security_domain:endpoint
