Kerberos Network Traffic RC4 Ticket Encryption — Sigma Rule

Rule metadata and linked tags

Author: sigma. Source status: test; severity: medium. Source dates: 2020-02-12 / 2021-11-27.

{
  "product": "zeek",
  "service": "kerberos"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 7cd43c7f1e4861c716520d6cced995adb96bea6fb7daa4d5d5862b4e3258460c

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Kerberos Network Traffic RC4 Ticket Encryption
id: 503fe26e-b5f2-4944-a126-eab405cc06e5
status: test
description: Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting
references:
    - https://adsecurity.org/?p=3458
author: sigma
date: 2020-02-12
modified: 2021-11-27
tags:
    - attack.credential-access
    - attack.t1558.003
logsource:
    product: zeek
    service: kerberos
detection:
    selection:
        request_type: 'TGS'
        cipher: 'rc4-hmac'
    computer_acct:
        service|startswith: '$'
    condition: selection and not computer_acct
falsepositives:
    - Normal enterprise SPN requests activity
level: medium

Original YAML and metadata in JSON

False positives

• Normal enterprise SPN requests activity

Source references

• https://adsecurity.org/?p=3458