sigma-rules/rules/windows/credential_access_posh_request_ticket.toml

[metadata]
creation_date = "2022/01/24"
maturity = "production"
updated_date = "2022/02/28"

[rule]
author = ["Elastic"]
description = """
Detects PowerShell scripts that have the capability of requesting kerberos tickets, which is a common step in
Kerberoasting toolkits to crack service accounts.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-windows.*"]
language = "kuery"
license = "Elastic License v2"
name = "PowerShell Kerberos Ticket Request"
note = """## Triage and analysis

### Investigating Explicit PowerShell Kerberos Ticket Request

PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks, making
it available for use in various environments, creating an attractive way for attackers to execute code.

Accounts associated with a service principal name (SPN) are viable targets for Kerberoasting attacks, which use brute
force to crack the user password, which is used to encrypt a Kerberos TGS ticket.

Attackers can use PowerShell to request these Kerberos tickets, with the intent of extracting them from memory to
perform Kerberoasting.

#### Possible investigation steps

- Retrieve the script contents.
- Investigate the script execution chain (parent process tree).
- Investigate if the script was executed, and if so, which account was targeted.
- Check whether this user should be doing this kind of activity.
- Contact the account owner and confirm whether they are aware of this activity.
- Check if the script has any other functionality that can be potentially malicious.
- Investigate other alerts related to the host and user in the last 48 hours.
- Review event ID [4769](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4769)
related to this account and service name for additional information.

### False positive analysis

- A possible false positive can be identified if the script content is not malicious/harmful or does not request
Kerberos tickets for user accounts, as computer accounts are not vulnerable to Kerberoasting due to complex password
requirements and policy.

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Reset the password of the involved accounts. Priority should be given to privileged accounts.
- Quarantine the involved host for forensic investigation, as well as eradication and recovery activities.
"""
references = [
    "https://cobalt.io/blog/kerberoast-attack-techniques",
    "https://github.com/EmpireProject/Empire/blob/master/data/module_source/credentials/Invoke-Kerberoast.ps1",
]
risk_score = 47
rule_id = "eb610e70-f9e6-4949-82b9-f1c5bcd37c39"
severity = "medium"
tags = ["Elastic", "Host", "Windows", "Threat Detection", "Credential Access"]
timestamp_override = "event.ingested"
type = "query"

query = '''
event.category:process and 
  powershell.file.script_block_text : (
    KerberosRequestorSecurityToken
  )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"

[[rule.threat.technique]]
id = "T1558"
name = "Steal or Forge Kerberos Tickets"
reference = "https://attack.mitre.org/techniques/T1558/"

    [[rule.threat.technique.subtechnique]]
    id = "T1558.003"
    name = "Kerberoasting"
    reference = "https://attack.mitre.org/techniques/T1558/003/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

    [[rule.threat.technique.subtechnique]]
    id = "T1059.001"
    name = "PowerShell"
    reference = "https://attack.mitre.org/techniques/T1059/001/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"