mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-08 18:23:52 +00:00
68fd20cb66
Fixed rules - rules/windows/builtin/win_susp_msmpeng_crash.yml - rules/windows/builtin/win_alert_active_directory_user_control.yml - rules/windows/builtin/win_av_relevant_match.yml - rules/windows/builtin/win_mal_creddumper.yml - rules/windows/builtin/win_susp_sam_dump.yml - rules/windows/builtin/win_alert_mimikatz_keywords.yml - rules/windows/builtin/win_alert_enable_weak_encryption.yml
29 lines
985 B
YAML
29 lines
985 B
YAML
title: Weak Encryption Enabled and Kerberoast
|
|
description: Detects scenario where weak encryption is enabled for a user profile which could be used for hash/password cracking.
|
|
references:
|
|
- https://adsecurity.org/?p=2053
|
|
- https://www.harmj0y.net/blog/activedirectory/roasting-as-reps/
|
|
author: '@neu5ron'
|
|
tags:
|
|
- attack.defense_evasion
|
|
- attack.t1089
|
|
logsource:
|
|
product: windows
|
|
service: security
|
|
definition: 'Requirements: Audit Policy : Account Management > Audit User Account Management, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit User Account Management'
|
|
detection:
|
|
selection:
|
|
EventID: 4738
|
|
keywords:
|
|
Message:
|
|
- '*DES*'
|
|
- '*Preauth*'
|
|
- '*Encrypted*'
|
|
filters:
|
|
Message:
|
|
- '*Enabled*'
|
|
condition: selection and keywords and filters
|
|
falsepositives:
|
|
- Unknown
|
|
level: high
|