Sigma medium test sigma

Suspicious Kerberos RC4 Ticket Encryption

Detects service ticket requests using RC4 encryption type

View Source

Detection Logic

{
  "selection": {
    "EventID": 4769,
    "TicketOptions": "0x40810000",
    "TicketEncryptionType": "0x17"
  },
  "reduction": {
    "ServiceName
| endswith": "$"
  },
  "condition": "selection and not reduction"
}

False Positives

  • ⚠ Service accounts used on legacy systems (e.g. NetApp)
  • ⚠ Windows Domains with DFL 2003 and legacy systems

Field Validations

Loading…

Comments (0)

Loading comments...