Mika Ayenson
a52751494e
* Convert config header to setup in note field * Parse note field into separate setup and note field with marko gfm * only validate and parse note on elastic authored rules and add CLI description for new DR_BYPASS_NOTE_VALIDATION_AND_PARSE environment variable Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com>
107 lines
4.7 KiB
TOML
107 lines
4.7 KiB
TOML
[metadata]
|
||
creation_date = "2022/01/24"
|
||
maturity = "production"
|
||
updated_date = "2022/05/09"
|
||
|
||
[rule]
|
||
author = ["Elastic"]
|
||
description = """
|
||
Identifies the modification of an account's Kerberos pre-authentication options. An adversary with GenericWrite/GenericAll rights over
|
||
the account can maliciously modify these settings to perform offline password cracking attacks such as AS-REP roasting.
|
||
"""
|
||
from = "now-9m"
|
||
index = ["winlogbeat-*", "logs-system.*"]
|
||
language = "kuery"
|
||
license = "Elastic License v2"
|
||
name = "Kerberos Pre-authentication Disabled for User"
|
||
note = """## Triage and analysis
|
||
|
||
### Investigating Kerberos Pre-authentication Disabled for User
|
||
|
||
Kerberos pre-authentication is an account protection against offline password cracking. When enabled, a user requesting
|
||
access to a resource initiates communication with the Domain Controller (DC) by sending an Authentication Server Request
|
||
(AS-REQ) message with a timestamp that is encrypted with the hash of their password. If and only if the DC is able to
|
||
successfully decrypt the timestamp with the hash of the user’s password, it will then send an Authentication Server
|
||
Response (AS-REP) message that contains the Ticket Granting Ticket (TGT) to the user. Part of the AS-REP message is
|
||
signed with the user’s password. Microsoft's security monitoring [recommendations](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738) state that `'Don't Require Preauth' – Enabled` should not be enabled for user accounts because it weakens security for the account’s Kerberos authentication.
|
||
|
||
AS-REP roasting is an attack against Kerberos for user accounts that do not require pre-authentication, which means that
|
||
if the target user has pre-authentication disabled, an attacker can request authentication data for it and get a TGT that
|
||
can be brute-forced offline, similarly to Kerberoasting.
|
||
|
||
#### Possible investigation steps
|
||
|
||
- Identify the user account that performed the action and whether it should perform this kind of action.
|
||
- Contact the account owner and confirm whether they are aware of this activity.
|
||
- Determine if the target account is sensitive or privileged.
|
||
- Inspect the account activities for suspicious or abnormal behaviors in the alert timeframe.
|
||
|
||
### False positive analysis
|
||
|
||
- Disabling pre-authentication is a bad security practice and should not be allowed in the domain. The security team
|
||
should map and monitor any potential benign true positives (B-TPs), especially if the target account is privileged.
|
||
|
||
### Response and remediation
|
||
|
||
- Initiate the incident response process based on the outcome of the triage.
|
||
- Reset the target account's password if there is any risk of TGTs having been retrieved.
|
||
- Re-enable the preauthentication option or disable the target account.
|
||
- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.
|
||
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
|
||
identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
|
||
systems, and web services.
|
||
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
|
||
mean time to respond (MTTR).
|
||
|
||
## Setup
|
||
|
||
The 'Audit User Account Management' logging policy must be configured for (Success, Failure).
|
||
Steps to implement the logging policy with Advanced Audit Configuration:
|
||
|
||
```
|
||
Computer Configuration >
|
||
Policies >
|
||
Windows Settings >
|
||
Security Settings >
|
||
Advanced Audit Policies Configuration >
|
||
Audit Policies >
|
||
Account Management >
|
||
Audit User Account Management (Success,Failure)
|
||
```
|
||
"""
|
||
references = [
|
||
"https://harmj0y.medium.com/roasting-as-reps-e6179a65216b",
|
||
"https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738",
|
||
"https://github.com/atc-project/atomic-threat-coverage/blob/master/Atomic_Threat_Coverage/Logging_Policies/LP_0026_windows_audit_user_account_management.md"
|
||
]
|
||
risk_score = 47
|
||
rule_id = "e514d8cd-ed15-4011-84e2-d15147e059f1"
|
||
severity = "medium"
|
||
tags = ["Elastic", "Host", "Windows", "Threat Detection", "Credential Access"]
|
||
timestamp_override = "event.ingested"
|
||
type = "query"
|
||
|
||
query = '''
|
||
event.code:4738 and message:"'Don't Require Preauth' - Enabled"
|
||
'''
|
||
|
||
|
||
[[rule.threat]]
|
||
framework = "MITRE ATT&CK"
|
||
|
||
[[rule.threat.technique]]
|
||
id = "T1558"
|
||
name = "Steal or Forge Kerberos Tickets"
|
||
reference = "https://attack.mitre.org/techniques/T1558/"
|
||
|
||
[[rule.threat.technique.subtechnique]]
|
||
name = "AS-REP Roasting"
|
||
id = "T1558.004"
|
||
reference = "https://attack.mitre.org/techniques/T1558/004/"
|
||
|
||
[rule.threat.tactic]
|
||
id = "TA0006"
|
||
name = "Credential Access"
|
||
reference = "https://attack.mitre.org/tactics/TA0006/"
|
||
|