IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

« Service Control Spawned via Script Interpreter Setuid / Setgid Bit Set via chmod »

› › ›

Service Creation via Local Kerberos Authentication

edit

Service Creation via Local Kerberos Authentication

edit

Identifies a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, followed by a sevice creation from the same LogonId. This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined user to local System privileges.

Rule type: eql

Rule indices:

winlogbeat-*
logs-system.*

Severity: high

Risk score: 73

Runs every: 5 minutes

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Elastic
Host
Windows
Threat Detection
Privilege Escalation
Credential Access

Version: 2 (version history)

Added (Elastic Stack release): 8.3.0

Last modified (Elastic Stack release): 8.4.0

Rule authors: Elastic

Rule license: Elastic License v2

Rule query

edit

sequence by host.id with maxspan=5m [authentication where /* event
4624 need to be logged */ event.action == "logged-in" and
event.outcome == "success" and /* authenticate locally using
relayed kerberos Ticket */
winlog.event_data.AuthenticationPackageName :"Kerberos" and
winlog.logon.type == "Network" and cidrmatch(source.ip,
"127.0.0.0/8", "::1") and source.port > 0] by
winlog.event_data.TargetLogonId [any where /* event 4697 need to
be logged */ event.action : "service-installed"] by
winlog.event_data.SubjectLogonId

Threat mapping

edit

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Privilege Escalation
- ID: TA0004
- Reference URL: https://attack.mitre.org/tactics/TA0004/
Technique:
- Name: Create or Modify System Process
- ID: T1543
- Reference URL: https://attack.mitre.org/techniques/T1543/
Tactic:
- Name: Credential Access
- ID: TA0006
- Reference URL: https://attack.mitre.org/tactics/TA0006/
Technique:
- Name: Steal or Forge Kerberos Tickets
- ID: T1558
- Reference URL: https://attack.mitre.org/techniques/T1558/

Rule version history

edit

Version 2 (8.4.0 release)

Formatting only

« Service Control Spawned via Script Interpreter Setuid / Setgid Bit Set via chmod »