mdecrevoisier high stable sigma

Administrator login impersonation with forged Golden ticket

Detects scenarios where an attacker used a forged Golden ticket to login on a remote host. Per default or if specified, the ticket will be forged using the builtin administrator account (SID *-500). However, and it frequent cases, a non suspicious user name will be specificied during the forge in order to evade security monitoring. The rule works based on this trick.

View Source

Detection Logic

{
  "selection": {
    "EventID": 4624,
    "TargetUserSid
| endswith": "-500",
    "LogonProcessName": "Kerberos"
  },
  "filter": {
    "TargetUserName": [
      "Administrator",
      "Järjestelmänvalvoja",
      "Administrateur",
      "Administrador",
      "Administratör",
      "Rendszergazda",
      "Администратор"
    ]
  },
  "condition": "selection and not filter"
}

False Positives

⚠ login with renamed builtin administrator account ("administrator" renamed to "admin_org")

Field Validations

Loading…

Comments (0)

Loading comments...