Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionlowtest

No Suitable Encryption Key Found For Generating Kerberos Ticket

Detects errors when a target server doesn't have suitable keys for generating kerberos tickets. This issue can occur for example when a service uses a user account or a computer account that is configured for only DES encryption on a computer that is running Windows 7 which has DES encryption for Kerberos authentication disabled.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
@serkinvaleryCreated Thu Mar 07Updated Mon Sep 22b1e0b3f5-b62e-41be-886a-daffde446ad4windows
Log Source
Windowssystem
ProductWindows← raw: windows
Servicesystem← raw: system
Detection Logic
Detection Logic1 selector
detection:
    selection:
        Provider_Name:
            - 'Kerberos-Key-Distribution-Center'
            - 'Microsoft-Windows-Kerberos-Key-Distribution-Center'
        EventID:
            - 16 # KDCEVENT_NO_KEY_INTERSECTION_TGS
            - 27 # KDCEVENT_UNSUPPORTED_ETYPE_REQUEST_TGS
    condition: selection
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References
1
Resolving title…
learn.microsoft.com
2
Resolving title…
learn.microsoft.com
MITRE ATT&CK
Rule Metadata
Rule ID
b1e0b3f5-b62e-41be-886a-daffde446ad4
Status
test
Level
low
Type
Detection
Created
Thu Mar 07
Modified
Mon Sep 22
Author
@serkinvalery
Path
rules/windows/builtin/system/microsoft_windows_kerberos_key_distribution_center/win_system_kdcsvc_tgs_no_suitable_encryption_key_found.yml
Raw Tags
attack.credential-accessattack.t1558.003
View on GitHub