Detectionmediumtest

Suspicious Kerberos RC4 Ticket Encryption

Detects service ticket requests using RC4 encryption type

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Florian Roth (Nextron Systems)Created Mon Feb 06Updated Sun Jun 19496a0e47-0a33-4dca-b009-9e6ca3591f39windows
Log Source
Windowssecurity
ProductWindows← raw: windows
Servicesecurity← raw: security
Detection Logic
Detection Logic2 selectors
detection:
    selection:
        EventID: 4769
        TicketOptions: '0x40810000'
        TicketEncryptionType: '0x17'
    reduction:
        ServiceName|endswith: '$'
    condition: selection and not reduction
False Positives

Service accounts used on legacy systems (e.g. NetApp)

Windows Domains with DFL 2003 and legacy systems

Rule Metadata
Rule ID
496a0e47-0a33-4dca-b009-9e6ca3591f39
Status
test
Level
medium
Type
Detection
Created
Mon Feb 06
Modified
Sun Jun 19
Path
rules/windows/builtin/security/win_security_susp_rc4_kerberos.yml
Raw Tags
attack.credential-accessattack.t1558.003
View on GitHub