IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Kerberos Cached Credentials Dumping Kernel Module Removal »
Elastic Docs ›Elastic Security Solution [7.16] ›Detections and alerts ›Prebuilt rule reference

Kerberos Traffic from Unusual Process

edit

Kerberos Traffic from Unusual Process

edit

Identifies network connections to the standard Kerberos port from an unusual process. On Windows, the only process that normally performs Kerberos traffic from a domain joined host is lsass.exe.

Rule type: eql

Rule indices:

  • logs-endpoint.events.*
  • winlogbeat-*
  • logs-windows.*

Severity: medium

Risk score: 47

Runs every: 5 minutes

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

Tags:

  • Elastic
  • Host
  • Windows
  • Threat Detection
  • Credential Access

Version: 4 (version history)

Added (Elastic Stack release): 7.11.0

Last modified (Elastic Stack release): 7.16.0

Rule authors: Elastic

Rule license: Elastic License v2

Potential false positives

edit

HTTP traffic on a non standard port. Verify that the destination IP address is not related to a Domain Controller.

Rule query

edit
network where event.type == "start" and network.direction :
("outgoing", "egress") and destination.port == 88 and source.port >=
49152 and process.executable != "C:\\Windows\\System32\\lsass.exe"
and destination.address !="127.0.0.1" and destination.address !="::1"
and /* insert False Positives here */ not process.name in
("swi_fc.exe", "fsIPcam.exe", "IPCamera.exe", "MicrosoftEdgeCP.exe",
"MicrosoftEdge.exe", "iexplore.exe", "chrome.exe", "msedge.exe",
"opera.exe", "firefox.exe")

Threat mapping

edit

Framework: MITRE ATT&CKTM

Rule version history

edit
Version 4 (7.16.0 release)

  • Updated query, changed from:

    network where event.type == "start" and network.direction ==
"outgoing" and destination.port == 88 and source.port >= 49152 and
process.executable != "C:\\Windows\\System32\\lsass.exe" and
destination.address !="127.0.0.1" and destination.address !="::1" and
/* insert False Positives here */ not process.name in ("swi_fc.exe",
"fsIPcam.exe", "IPCamera.exe", "MicrosoftEdgeCP.exe",
"MicrosoftEdge.exe", "iexplore.exe", "chrome.exe", "msedge.exe",
"opera.exe", "firefox.exe")
Version 3 (7.12.0 release)
  • Formatting only
Version 2 (7.11.2 release)
  • Formatting only
« Kerberos Cached Credentials Dumping Kernel Module Removal »