Kerberos Ticket Request With Forwardable Or Constrained Delegation Options
Query
SecurityEvent
| where EventID == 4769
| extend xml = parse_xml(strcat("<Root>", EventData, "</Root>"))
| mv-apply Data = xml.Root.EventData.Data on (
summarize EventDataBag = make_bag(
pack(tostring(Data["@Name"]), tostring(Data["#text"]))
)
)
| evaluate bag_unpack(EventDataBag, columnsConflict='replace_source')
| extend TicketOptionsLong = tolong(TicketOptions)
| extend IsForwarded = binary_and(TicketOptionsLong, 0x20000000) != 0
| extend IsConstrainedDelegation = isnotempty(TransmittedServices) and TransmittedServices != "-"
| where IsForwarded == "true" or IsConstrainedDelegation == "true"About this query
Kerberos Ticket Request with Forwardable or Constrained Delegation Options
Query Information
MITRE ATT&CK Technique(s)
| Technique ID | Title | Link |
|---|---|---|
| T1558 | Steal or Forge Kerberos Tickets | https://attack.mitre.org/techniques/T1558 |
Description
This rule detects potential account compromise or lateral movement by monitoring for significant spikes in the number of unique devices a single user account is logging into. It calculates a rolling baseline of daily device usage per account over the last 30 days and triggers an alert when an account's maximum daily unique device count exceeds its average by more than 5 times, with a minimum threshold of 10 unique devices, excluding known system accounts and infrastructure servers.
Author <Optional>
- Name: Benjamin Zulliger
- Github: https://github.com/benscha/KQLAdvancedHunting
- LinkedIn: https://www.linkedin.com/in/benjamin-zulliger/
Defender XDR
Explanation
This query is designed to detect suspicious activity related to Kerberos ticket requests, specifically focusing on potential account compromise or lateral movement within a network. Here's a simplified breakdown of what the query does:
-
Data Source: It starts by looking at security events with the specific EventID 4769, which is related to Kerberos service ticket operations.
-
Data Parsing: The query extracts and organizes the event data into a structured format using XML parsing techniques. This helps in analyzing specific fields within the event data.
-
Ticket Options Analysis: It checks the ticket options to determine if certain flags are set:
- IsForwarded: This flag is checked by performing a bitwise operation to see if the ticket has been forwarded, which might indicate an attempt to use the ticket on another device.
- IsConstrainedDelegation: This checks if the ticket is being used with constrained delegation, which allows a service to impersonate users to access resources on their behalf.
-
Filtering: The query filters the results to only include events where either the ticket has been forwarded or constrained delegation is being used. These conditions can be indicative of abnormal or potentially malicious behavior.
In essence, this query helps identify unusual patterns in how user accounts are accessing devices, potentially signaling a security threat such as an account being used to move laterally across a network.