SigmaHQ/rules/windows/builtin/win_susp_rc4_kerberos.yml

title: Suspicious Kerberos RC4 Ticket Encryption
status: experimental
reference: https://adsecurity.org/?p=3458
description: Detects logons using RC4 encryption type
logsource:
    - product: windows
detection:
    selection:
        EventLog: Security
        EventID: 4769
        TicketOptions: '0x40810000'
        TicketEncryption: '0x17'
    reduction:
        - ServiceName: '$*'
        - Type: 'Success Audit'
    condition: selection and not reduction
falsepositives:
    - Service accounts used on legacy systems (e.g. NetApp)
    - Windows Domains with DFL 2003 and legacy systems
level: medium
Rew rule examples: RC4 Kerberos, JAVA remote debugging process 2017-02-06 19:03:42 +00:00			`title: Suspicious Kerberos RC4 Ticket Encryption`
			`status: experimental`
			`reference: https://adsecurity.org/?p=3458`
Sysmon rules 'logsource' change 2017-02-19 08:19:06 +00:00			`description: Detects logons using RC4 encryption type`
Added "logsource" sections and new rule 2017-02-18 23:31:59 +00:00			`logsource:`
			`- product: windows`
Rew rule examples: RC4 Kerberos, JAVA remote debugging process 2017-02-06 19:03:42 +00:00			`detection:`
			`selection:`
Rule review and cleanup * removed unnecessary one element lists from definitions * converted some lists of one element maps to maps because the resulting OR linkage would cause wrong result. 2017-02-15 22:53:08 +00:00			`EventLog: Security`
			`EventID: 4769`
			`TicketOptions: '0x40810000'`
			`TicketEncryption: '0x17'`
Rew rule examples: RC4 Kerberos, JAVA remote debugging process 2017-02-06 19:03:42 +00:00			`reduction:`
			`- ServiceName: '$*'`
			`- Type: 'Success Audit'`
			`condition: selection and not reduction`
			`falsepositives:`
			`- Service accounts used on legacy systems (e.g. NetApp)`
			`- Windows Domains with DFL 2003 and legacy systems`
Levels to low, medium, high, critical 2017-02-16 17:02:26 +00:00			`level: medium`