heroui logo

Suspicious Kerberos Service Ticket Request

Splunk Security Content

View Source
Summary
This detection rule monitors for suspicious Kerberos Service Ticket requests (Event ID 4769) where the requesting user account matches the service name, which can indicate a potential exploitation attempt of Critical Vulnerabilities CVE-2021-42278 and CVE-2021-42287. If an adversary is able to impersonate a domain controller through this method, it could enable them to escalate privileges and gain complete control of the domain, leading to unauthorized access to sensitive data. This detection is significant given the severe consequences involved and the critical nature of security in managing access to domain resources.
Categories
  • Endpoint
  • Identity Management
  • Windows
Data Sources
  • Windows Registry
  • User Account
  • Windows Registry
  • Application Log
ATT&CK Techniques
  • T1078
  • T1078.002
  • T1070.001
Created: 2024-11-13