Name:Windows Kerberos Local Successful Logon id:8309c3a8-4d34-48ae-ad66-631658214653 version:15 date:None author:Michael Haag, Splunk status:production type:TTP Description:The following analytic identifies a local successful authentication event on a Windows endpoint using the Kerberos package.
It detects EventCode 4624 with LogonType 3 and source address 127.0.0.1, indicating a login to the built-in local Administrator account.
This activity is significant as it may suggest a Kerberos relay attack, a method attackers use to escalate privileges.
If confirmed malicious, this could allow an attacker to gain unauthorized access to sensitive systems, execute arbitrary code, or create new accounts in Active Directory, leading to potential system compromise. Data_source:
| fillnull | stats count min(_time) as firstTime max(_time) as lastTime BY action app authentication_method dest dvc process process_id process_name process_path signature signature_id src src_port status subject user user_group vendor_product
| lookup update=true domain_controllers sAMAccountName as dest OUTPUT isDC | where isnull(isDC) | fields - isDC
how_to_implement:To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4624 EventCode enabled. The Windows TA is also required.
Populate the `domain_controllers` lookup with the hostnames that appear in the `dest` field for domain controllers in your environment. known_false_positives:False positives are possible, particularly from domain controllers that use Kerberos SSP and loopback authentication.
Add known domain controllers to the `domain_controllers` lookup to suppress those results. Filter as needed. References: -https://github.com/Dec0ne/KrbRelayUp drilldown_searches: name:'View the detection results for - "$dest$"' search:'%original_detection_search% | search dest = "$dest$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$dest$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['Local Privilege Escalation With KrbRelayUp', 'Active Directory Kerberos Attacks', 'Compromised Windows Host', 'Scattered Lapsus$ Hunters']
