Hayabusa medium test sigma

Suspicious Kerberos RC4 Ticket Encryption

Detects service ticket requests using RC4 encryption type

View Source

Detection Logic

{
  "security": {
    "Channel": "Security"
  },
  "selection": {
    "EventID": 4769,
    "TicketOptions": "0x40810000",
    "TicketEncryptionType": "0x17"
  },
  "reduction": {
    "ServiceName
| endswith": "$"
  },
  "condition": "security and (selection and not reduction)"
}

False Positives

  • ⚠ Service accounts used on legacy systems (e.g. NetApp)
  • ⚠ Windows Domains with DFL 2003 and legacy systems

Field Validations

Loading…

Comments (0)

Loading comments...