Elastic Defend high stable eql

Potential Kerberos Attack via Bifrost

Identifies use of Bifrost, a known macOS Kerberos pentesting tool, which can be used to dump cached Kerberos tickets or attempt unauthorized authentication techniques such as pass-the-ticket/hash and kerberoasting.

View Source

Detection Logic

process where event.type == "start" and process.args like~ "-action" and
 (
  process.args like~ ("-kerberoast", "askhash", "asktgs", "asktgt", "s4u") or
  (process.args like~ "-ticket" and process.args like~ "ptt") or
  (process.args like~ "dump" and process.args in~ ("tickets", "keytab"))
  )

Field Validations

Loading…

Comments (0)

Loading comments...