Detectionmediumtest
Suspicious Kerberos RC4 Ticket Encryption
Detects service ticket requests using RC4 encryption type
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Florian Roth (Nextron Systems)Created Mon Feb 06Updated Sun Jun 19496a0e47-0a33-4dca-b009-9e6ca3591f39windows
Log Source
Windowssecurity
ProductWindows← raw: windows
Servicesecurity← raw: security
Detection Logic
Detection Logic2 selectors
detection:
selection:
EventID: 4769
TicketOptions: '0x40810000'
TicketEncryptionType: '0x17'
reduction:
ServiceName|endswith: '$'
condition: selection and not reductionFalse Positives
Service accounts used on legacy systems (e.g. NetApp)
Windows Domains with DFL 2003 and legacy systems
MITRE ATT&CK
Tactics
Sub-techniques
Rule Metadata
Rule ID
496a0e47-0a33-4dca-b009-9e6ca3591f39
Status
test
Level
medium
Type
Detection
Created
Mon Feb 06
Modified
Sun Jun 19
Path
rules/windows/builtin/security/win_security_susp_rc4_kerberos.yml
Raw Tags
attack.credential-accessattack.t1558.003