Elastic Defend high stable eql

Kerberos Config File Accessed by Untrusted or Unsigned Process

Identifies an untrusted or unsigned process accessing the Kerberos configuration file. Adversaries may attempt to access this file in order to gain situational awareness regarding the Active Directory domain to include its structure and settings.

View Source

Detection Logic

file where event.action == "open" and 
 file.path like "/etc/krb5.conf" and 
 (process.code_signature.trusted == false or process.code_signature.exists == false)

Field Validations

Loading…

Comments (0)

Loading comments...