Elastic medium stable eql

PKINIT Followed by Same-Principal U2U Service Ticket

Identifies a successful PKINIT ticket-granting ticket request followed within five seconds on the same domain controller and source address by a successful user-to-user service-ticket request whose service SID matches the PKINIT principal SID. This sequence is consistent with the KDC-visible ticket requests used in an UnPAC-the-Hash attack, before client-side PAC credential decryption and NT hash recovery. The certificate used for PKINIT may have been obtained through CertiGhost or another certificate-abuse path.

View Source

Detection Logic

sequence by winlog.computer_name, source.ip with maxspan=5s
  [authentication where host.os.type == "windows" and
    event.code == "4768" and winlog.event_data.PreAuthType == "16" and
    winlog.event_data.Status == "0x0"
  ] by winlog.event_data.TargetSid
  [authentication where host.os.type == "windows" and
    event.code == "4769" and winlog.event_data.Status == "0x0" and
    winlog.event_data.TicketOptions in ("0x40810008", "0x40810018")
  ] by winlog.event_data.ServiceSid

Field Validations

Loading…

Comments (0)

Loading comments...