SigmaHQ/rules/windows/builtin/win_alert_enable_weak_encryption.yml

title: Weak Encryption Enabled and Kerberoast
id: f6de9536-0441-4b3f-a646-f4e00f300ffd
description: Detects scenario where weak encryption is enabled for a user profile which could be used for hash/password cracking.
references:
    - https://adsecurity.org/?p=2053
    - https://www.harmj0y.net/blog/activedirectory/roasting-as-reps/
author: '@neu5ron'
date: 2017/07/30
tags:
    - attack.defense_evasion
    - attack.t1089
    - attack.t1562.001
logsource:
    product: windows
    service: security
    definition: 'Requirements: Audit Policy : Account Management > Audit User Account Management, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit User Account Management'
detection:
    selection:
        EventID: 4738
    keywords:
        Message:
            - '*DES*'
            - '*Preauth*'
            - '*Encrypted*'
    filters:
        Message:
            - '*Enabled*'
    condition: selection and keywords and filters
falsepositives:
    - Unknown
level: high
Massive Title Cleanup 2018-01-27 09:57:30 +00:00			`title: Weak Encryption Enabled and Kerberoast`
Added UUIDs to rules 2019-11-12 22:12:27 +00:00			`id: f6de9536-0441-4b3f-a646-f4e00f300ffd`
Create win_alert_enable_weak_encryption.yml kerberoast and enabling weak encryption for password/hash cracking 2017-04-03 13:12:58 +00:00			`description: Detects scenario where weak encryption is enabled for a user profile which could be used for hash/password cracking.`
Change All "str" references to be "list"to mach schema update 2018-01-27 23:24:16 +00:00			`references:`
Update win_alert_enable_weak_encryption.yml 2017-04-03 13:15:52 +00:00			`- https://adsecurity.org/?p=2053`
			`- https://www.harmj0y.net/blog/activedirectory/roasting-as-reps/`
yamllint: quote twitter-formatted nickname 2017-07-30 15:42:25 +00:00			`author: '@neu5ron'`
fix: fixed missing date fields in remaining files 2020-01-30 15:07:37 +00:00			`date: 2017/07/30`
Added missing tags and some minor improvements 2019-03-05 22:25:49 +00:00			`tags:`
			`- attack.defense_evasion`
			`- attack.t1089`
Initial round of subtechnique updates 2020-06-16 20:46:08 +00:00			`- attack.t1562.001`
Create win_alert_enable_weak_encryption.yml kerberoast and enabling weak encryption for password/hash cracking 2017-04-03 13:12:58 +00:00			`logsource:`
Update win_alert_enable_weak_encryption.yml 2017-04-03 13:15:52 +00:00			`product: windows`
			`service: security`
Replace "logsource: description" with "definition" to match the specs 2018-11-15 06:00:06 +00:00			`definition: 'Requirements: Audit Policy : Account Management > Audit User Account Management, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit User Account Management'`
Create win_alert_enable_weak_encryption.yml kerberoast and enabling weak encryption for password/hash cracking 2017-04-03 13:12:58 +00:00			`detection:`
Update win_alert_enable_weak_encryption.yml 2017-04-03 13:15:52 +00:00			`selection:`
			`EventID: 4738`
			`keywords:`
fix: bound windows event log rules to message field Fixed rules - rules/windows/builtin/win_susp_msmpeng_crash.yml - rules/windows/builtin/win_alert_active_directory_user_control.yml - rules/windows/builtin/win_av_relevant_match.yml - rules/windows/builtin/win_mal_creddumper.yml - rules/windows/builtin/win_susp_sam_dump.yml - rules/windows/builtin/win_alert_mimikatz_keywords.yml - rules/windows/builtin/win_alert_enable_weak_encryption.yml 2019-11-02 10:25:29 +00:00			`Message:`
Initial round of subtechnique updates 2020-06-16 20:46:08 +00:00			`- 'DES'`
			`- 'Preauth'`
			`- 'Encrypted'`
Update win_alert_enable_weak_encryption.yml 2017-04-03 13:15:52 +00:00			`filters:`
fix: bound windows event log rules to message field Fixed rules - rules/windows/builtin/win_susp_msmpeng_crash.yml - rules/windows/builtin/win_alert_active_directory_user_control.yml - rules/windows/builtin/win_av_relevant_match.yml - rules/windows/builtin/win_mal_creddumper.yml - rules/windows/builtin/win_susp_sam_dump.yml - rules/windows/builtin/win_alert_mimikatz_keywords.yml - rules/windows/builtin/win_alert_enable_weak_encryption.yml 2019-11-02 10:25:29 +00:00			`Message:`
			`- 'Enabled'`
Update win_alert_enable_weak_encryption.yml 2017-04-03 13:15:52 +00:00			`condition: selection and keywords and filters`
fix: fixed missing date fields in remaining files 2020-01-30 15:07:37 +00:00			`falsepositives:`
Update win_alert_enable_weak_encryption.yml 2017-04-03 13:15:52 +00:00			`- Unknown`
Create win_alert_enable_weak_encryption.yml kerberoast and enabling weak encryption for password/hash cracking 2017-04-03 13:12:58 +00:00			`level: high`