[New] Suspicious Kerberos Authentication Ticket Request (#5260)

* [New] Suspicious Kerberos Authentication Ticket Request

Multi-datasource correlation to detect suspicious Kerberos Authentication Ticket Request from the source machine and the Domain Controller.

* Update lateral_movement_credential_access_kerberos_correlation.toml

* Update rules/windows/lateral_movement_credential_access_kerberos_correlation.toml

Co-authored-by: Mika Ayenson, PhD <[email protected]>

* Update rules/windows/lateral_movement_credential_access_kerberos_correlation.toml

Co-authored-by: Terrance DeJesus <[email protected]>

* Update rules/windows/lateral_movement_credential_access_kerberos_correlation.toml

Co-authored-by: Jonhnathan <[email protected]>

* Update rules/windows/lateral_movement_credential_access_kerberos_correlation.toml

Co-authored-by: Jonhnathan <[email protected]>

* Update lateral_movement_credential_access_kerberos_correlation.toml

---------

Co-authored-by: Mika Ayenson, PhD <[email protected]>
Co-authored-by: Terrance DeJesus <[email protected]>
Co-authored-by: Jonhnathan <[email protected]>

Author: 4 people

rules/windows/lateral_movement_credential_access_kerberos_correlation.toml

@@ -0,0 +1,127 @@
+[metadata]
+creation_date = "2025/10/28"
+integration = ["endpoint", "windows", "system"]
+maturity = "production"
+updated_date = "2025/10/28"
+
+[rule]
+author = ["Elastic"]
+description = """
+Correlates network connections to the standard Kerberos port by an unusual process from the source machine with a Kerberos
+authentication ticket request from the target domain controller.
+"""
+from = "now-9m"
+index = [
+    "logs-endpoint.events.network-*",
+    "logs-windows.sysmon_operational-*",
+    "logs-system.security*",
+    "logs-windows.forwarded*",
+    "winlogbeat-*"
+]
+language = "eql"
+license = "Elastic License v2"
+name = "Suspicious Kerberos Authentication Ticket Request"
+note = """## Triage and analysis
+
+### Investigating Suspicious Kerberos Authentication Ticket Request
+
+Kerberos is the default authentication protocol in Active Directory, designed to provide strong authentication for client/server applications by using secret-key cryptography.
+
+Domain-joined hosts usually perform Kerberos traffic using the `lsass.exe` process. This rule detects the occurrence of traffic on the Kerberos port (88) by processes other than `lsass.exe` to detect the unusual request and usage of Kerberos tickets.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Check if the Destination IP is related to a Domain Controller.
+- Review events ID 4769 and 4768 for suspicious ticket requests.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+### False positive analysis
+
+- Active Directory audit tools.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+  - Ticket requests can be used to investigate potentially compromised accounts.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+"""
+references = [
+"https://github.com/its-a-feature/bifrost", 
+"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4768"
+]
+risk_score = 73
+rule_id = "c6b40f4c-c6a9-434e-adb8-989b0d06d005"
+severity = "high"
+tags = [
+    "Domain: Endpoint",
+    "Domain: Identity",
+    "OS: Windows",
+    "Use Case: Threat Detection",
+    "Tactic: Credential Access",
+    "Tactic: Lateral Movement",
+    "Use Case: Active Directory Monitoring",
+    "Data Source: Active Directory",
+    "Data Source: Elastic Defend",
+    "Data Source: Sysmon",
+    "Data Source: Windows Security Event Logs",
+    "Resources: Investigation Guide",
+]
+timestamp_override = "event.ingested"
+type = "eql"
+
+query = '''
+sequence by source.port, source.ip with maxspan=3s
+ [network where host.os.type == "windows" and destination.port == 88 and
+  process.executable != null and
+  not process.executable : ("?:\\Windows\\system32\\lsass.exe", "\\device\\harddiskvolume*\\windows\\system32\\lsass.exe") and
+  source.ip != "127.0.0.1" and destination.ip != "::1" and destination.ip != "127.0.0.1"]
+ [authentication where host.os.type == "windows" and event.code in ("4768", "4769")]
+'''
+
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+[[rule.threat.technique]]
+id = "T1550"
+name = "Use Alternate Authentication Material"
+reference = "https://attack.mitre.org/techniques/T1550/"
+[[rule.threat.technique.subtechnique]]
+id = "T1550.003"
+name = "Pass the Ticket"
+reference = "https://attack.mitre.org/techniques/T1550/003/"
+
+
+
+[rule.threat.tactic]
+id = "TA0008"
+name = "Lateral Movement"
+reference = "https://attack.mitre.org/tactics/TA0008/"
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+[[rule.threat.technique]]
+id = "T1558"
+name = "Steal or Forge Kerberos Tickets"
+reference = "https://attack.mitre.org/techniques/T1558/"
+[[rule.threat.technique.subtechnique]]
+id = "T1558.003"
+name = "Kerberoasting"
+reference = "https://attack.mitre.org/techniques/T1558/003/"
+
+
+
+[rule.threat.tactic]
+id = "TA0006"
+name = "Credential Access"
+reference = "https://attack.mitre.org/tactics/TA0006/"