From cbf465ba01ed0efbe58ba97e3783347f4627e98c Mon Sep 17 00:00:00 2001 From: Samirbous <64742097+Samirbous@users.noreply.github.com> Date: Wed, 30 Sep 2020 23:03:44 +0200 Subject: [PATCH] [New Rule] Kerberos dump using kcc command (#139) * [New Rule] Kerberos dump using kcc command * Delete .gitignore * Delete vcs.xml * Delete profiles_settings.xml * Delete misc.xml * Delete rules.iml * Delete modules.xml * Update credential_access_kerberosdump_kcc.toml * Update rules/macos/credential_access_kerberosdump_kcc.toml Co-authored-by: Justin Ibarra * Update rules/macos/credential_access_kerberosdump_kcc.toml Co-authored-by: Justin Ibarra * Update credential_access_kerberosdump_kcc.toml * Update rules/macos/credential_access_kerberosdump_kcc.toml Co-authored-by: Justin Ibarra * Update rules/macos/credential_access_kerberosdump_kcc.toml Co-authored-by: Justin Ibarra * Update rules/macos/credential_access_kerberosdump_kcc.toml Co-authored-by: Justin Ibarra * Update rules/macos/credential_access_kerberosdump_kcc.toml Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> * Update rules/macos/credential_access_kerberosdump_kcc.toml Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> * Update rules/macos/credential_access_kerberosdump_kcc.toml Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> * Update credential_access_kerberosdump_kcc.toml Co-authored-by: Justin Ibarra Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> --- .../credential_access_kerberosdump_kcc.toml | 42 +++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 rules/macos/credential_access_kerberosdump_kcc.toml diff --git a/rules/macos/credential_access_kerberosdump_kcc.toml b/rules/macos/credential_access_kerberosdump_kcc.toml new file mode 100644 index 000000000..fd6aa6a54 --- /dev/null +++ b/rules/macos/credential_access_kerberosdump_kcc.toml @@ -0,0 +1,42 @@ +[metadata] +creation_date = "2020/08/14" +ecs_version = ["1.6.0"] +maturity = "production" +updated_date = "2020/08/14" + +[rule] +author = ["Elastic"] +description = "Identifies the use of the Kerberos credential cache (kcc) utility to dump locally cached Kerberos tickets." +index = ["auditbeat-*", "logs-endpoint.events.*"] +language = "kuery" +license = "Elastic License" +name = "Kerberos Cached Credentials Dumping" +references = [ + "https://github.com/EmpireProject/EmPyre/blob/master/lib/modules/collection/osx/kerberosdump.py", + "https://opensource.apple.com/source/Heimdal/Heimdal-323.12/kuser/kcc-commands.in.auto.html", +] +risk_score = 73 +rule_id = "ad88231f-e2ab-491c-8fc6-64746da26cfe" +severity = "high" +tags = ["Elastic", "MacOS"] +type = "query" + +query = ''' +event.category:process and event.type:(start or process_started) and + process.name:kcc and + process.args:copy_cred_cache +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1003" +name = "OS Credential Dumping" +reference = "https://attack.mitre.org/techniques/T1003/" + + +[rule.threat.tactic] +id = "TA0006" +name = "Credential Access" +reference = "https://attack.mitre.org/tactics/TA0006/"