SigmaHQ/rules/windows/builtin/win_alert_enable_weak_encryption.yml

title: Weak Encryption Enabled and Kerberoast
id: f6de9536-0441-4b3f-a646-f4e00f300ffd
description: Detects scenario where weak encryption is enabled for a user profile which could be used for hash/password cracking.
references:
    - https://adsecurity.org/?p=2053
    - https://www.harmj0y.net/blog/activedirectory/roasting-as-reps/
author: '@neu5ron'
date: 2017/07/30
tags:
    - attack.defense_evasion
    - attack.t1089          # an old one
    - attack.t1562.001
logsource:
    product: windows
    service: security
    definition: 'Requirements: Audit Policy : Account Management > Audit User Account Management, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit User Account Management'
detection:
    selection:
        EventID: 4738
    keywords:
        Message|contains:
            - 'DES'
            - 'Preauth'
            - 'Encrypted'
    filters:
        Message|contains:
            - 'Enabled'
    condition: selection and keywords and filters
falsepositives:
    - Unknown
level: high
Massive Title Cleanup 2018-01-27 09:57:30 +00:00			`title: Weak Encryption Enabled and Kerberoast`
Added UUIDs to rules 2019-11-12 22:12:27 +00:00			`id: f6de9536-0441-4b3f-a646-f4e00f300ffd`
Create win_alert_enable_weak_encryption.yml kerberoast and enabling weak encryption for password/hash cracking 2017-04-03 13:12:58 +00:00			`description: Detects scenario where weak encryption is enabled for a user profile which could be used for hash/password cracking.`
Change All "str" references to be "list"to mach schema update 2018-01-27 23:24:16 +00:00			`references:`
Update win_alert_enable_weak_encryption.yml 2017-04-03 13:15:52 +00:00			`- https://adsecurity.org/?p=2053`
			`- https://www.harmj0y.net/blog/activedirectory/roasting-as-reps/`
yamllint: quote twitter-formatted nickname 2017-07-30 15:42:25 +00:00			`author: '@neu5ron'`
fix: fixed missing date fields in remaining files 2020-01-30 15:07:37 +00:00			`date: 2017/07/30`
Added missing tags and some minor improvements 2019-03-05 22:25:49 +00:00			`tags:`
			`- attack.defense_evasion`
att&ck tags review: windows/builtin, windows/driver_load, windows/file_event, windows/image_load, windows/other 2020-08-24 23:09:17 +00:00			`- attack.t1089 # an old one`
Initial round of subtechnique updates 2020-06-16 20:46:08 +00:00			`- attack.t1562.001`
Create win_alert_enable_weak_encryption.yml kerberoast and enabling weak encryption for password/hash cracking 2017-04-03 13:12:58 +00:00			`logsource:`
Update win_alert_enable_weak_encryption.yml 2017-04-03 13:15:52 +00:00			`product: windows`
			`service: security`
Replace "logsource: description" with "definition" to match the specs 2018-11-15 06:00:06 +00:00			`definition: 'Requirements: Audit Policy : Account Management > Audit User Account Management, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit User Account Management'`
Create win_alert_enable_weak_encryption.yml kerberoast and enabling weak encryption for password/hash cracking 2017-04-03 13:12:58 +00:00			`detection:`
Update win_alert_enable_weak_encryption.yml 2017-04-03 13:15:52 +00:00			`selection:`
			`EventID: 4738`
			`keywords:`
Update win_alert_enable_weak_encryption.yml 2020-10-15 18:05:49 +00:00			`Message\|contains:`
			`- 'DES'`
			`- 'Preauth'`
			`- 'Encrypted'`
Update win_alert_enable_weak_encryption.yml 2017-04-03 13:15:52 +00:00			`filters:`
Update win_alert_enable_weak_encryption.yml 2020-10-15 18:05:49 +00:00			`Message\|contains:`
			`- 'Enabled'`
Update win_alert_enable_weak_encryption.yml 2017-04-03 13:15:52 +00:00			`condition: selection and keywords and filters`
fix: fixed missing date fields in remaining files 2020-01-30 15:07:37 +00:00			`falsepositives:`
Update win_alert_enable_weak_encryption.yml 2017-04-03 13:15:52 +00:00			`- Unknown`
Create win_alert_enable_weak_encryption.yml kerberoast and enabling weak encryption for password/hash cracking 2017-04-03 13:12:58 +00:00			`level: high`