Steal or Forge Kerberos Tickets

// T1558: Steal or Forge Kerberos Tickets — Multi-pattern detection
// Covers Kerberoasting (4769+RC4), AS-REP Roasting (4768+PreAuth=0),
// Golden Ticket indicators (RC4 TGT), and attack tool process signatures
let LookbackWindow = 24h;

// Pattern 1: Kerberoasting — RC4 TGS requests via EventID 4769
// In AES-enforced environments, any 0x17 service ticket request is high-fidelity
let Kerberoasting = SecurityEvent
| where TimeGenerated > ago(LookbackWindow)
| where EventID == 4769
| where TicketEncryptionType in ("0x17", "0x18")  // RC4-HMAC and RC4-HMAC-EXP
| where ServiceName !endswith "$"                   // Exclude machine account SPNs
| where ServiceName !in~ ("krbtgt", "kadmin/changepw")
| where IpAddress !in ("::1", "127.0.0.1", "-")
| where Status == "0x0"                              // Successful ticket grants only
| summarize
    RequestCount = count(),
    UniqueServices = dcount(ServiceName),
    Services = make_set(ServiceName, 20),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by AccountName, IpAddress, Computer
| extend AttackPattern = "Kerberoasting"
| extend RiskLevel = iff(UniqueServices >= 3 or RequestCount >= 5, "Critical", "High");

// Pattern 2: AS-REP Roasting — TGT for account with pre-auth disabled (EventID 4768)
let ASREPRoasting = SecurityEvent
| where TimeGenerated > ago(LookbackWindow)
| where EventID == 4768
| where PreAuthType == "0"                           // Pre-authentication not required
| where TicketEncryptionType in ("0x17", "0x18")    // Attacker requests RC4 for offline cracking
| where Status == "0x0"
| where IpAddress !in ("::1", "127.0.0.1", "-")
| project TimeGenerated, AccountName, IpAddress, Computer, TicketEncryptionType, PreAuthType
| extend AttackPattern = "AS-REP Roasting"
| extend RiskLevel = "High";

// Pattern 3: Golden Ticket indicator — RC4 TGT request (EventID 4768)
// Legitimate AES-only domains should not produce 0x17 TGT events
let GoldenTicketIndicators = SecurityEvent
| where TimeGenerated > ago(LookbackWindow)
| where EventID == 4768
| where TicketEncryptionType in ("0x17", "0x18")    // RC4 TGT is abnormal in AES-enforced domains
| where IpAddress !in ("::1", "127.0.0.1", "-")
| project TimeGenerated, AccountName, IpAddress, Computer, TicketEncryptionType, Status
| extend AttackPattern = "Potential Golden Ticket (RC4 TGT)"
| extend RiskLevel = "Critical";

// Pattern 4: Kerberos attack tool detection via process command line telemetry
let KerberosTools = DeviceProcessEvents
| where Timestamp > ago(LookbackWindow)
| where ProcessCommandLine has_any (
    "Rubeus", "kerberoast", "asreproast", "tgtdeleg", "asktgt", "asktgs",
    "harvest", "monitor", "s4u",
    "sekurlsa::tickets", "kerberos::golden", "kerberos::silver",
    "kerberos::ptt", "kerberos::list", "kerberos::purge", "kerberos::tgt",
    "GetUserSPNs", "GetNPUsers", "ticketer.py"
  )
  or FileName in~ ("Rubeus.exe", "Kekeo.exe")
  or ProcessCommandLine has ".kirbi"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine
| extend AttackPattern = "Kerberos Attack Tool"
| extend RiskLevel = "Critical";

// Unified output across all patterns
union
    (Kerberoasting
     | project TimeGenerated = LastSeen, Computer, AccountName, IpAddress,
         AttackPattern, RiskLevel,
         Details = strcat("RequestCount=", RequestCount, " UniqueServices=", UniqueServices, " SPNs=", tostring(Services))),
    (ASREPRoasting
     | project TimeGenerated, Computer, AccountName, IpAddress,
         AttackPattern, RiskLevel,
         Details = strcat("EncType=", TicketEncryptionType, " PreAuth=", PreAuthType)),
    (GoldenTicketIndicators
     | project TimeGenerated, Computer, AccountName, IpAddress,
         AttackPattern, RiskLevel,
         Details = strcat("EncType=", TicketEncryptionType, " Status=", Status)),
    (KerberosTools
     | project TimeGenerated = Timestamp, Computer = DeviceName, AccountName,
         IpAddress = "N/A (host-based)", AttackPattern, RiskLevel,
         Details = ProcessCommandLine)
| sort by TimeGenerated desc

(index=wineventlog (sourcetype="WinEventLog:Security" OR sourcetype="XmlWinEventLog:Security") (EventCode=4768 OR EventCode=4769 OR EventCode=4771))
OR
(index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (CommandLine="*Rubeus*" OR CommandLine="*kerberoast*" OR CommandLine="*GetUserSPNs*"
   OR CommandLine="*GetNPUsers*" OR CommandLine="*sekurlsa::tickets*"
   OR CommandLine="*kerberos::golden*" OR CommandLine="*kerberos::silver*"
   OR CommandLine="*kerberos::ptt*" OR CommandLine="*.kirbi*"
   OR CommandLine="*ticketer.py*" OR CommandLine="*tgtdeleg*" OR CommandLine="*asreproast*"
   OR Image="*\\Rubeus.exe" OR Image="*\\Kekeo.exe"))
| eval TicketEncType=coalesce('Ticket_Encryption_Type', TicketEncryptionType)
| eval SvcName=coalesce('Service_Name', ServiceName)
| eval PreAuth=coalesce('Pre_Authentication_Type', PreAuthType)
| eval ClientIP=coalesce('Client_Address', IpAddress, src_ip)
| eval ActName=coalesce('Account_Name', AccountName, user)
| eval IsKerberoasting=if(
    EventCode=4769
    AND (TicketEncType="0x17" OR TicketEncType="0x18")
    AND NOT like(SvcName, "%$")
    AND SvcName!="krbtgt" AND SvcName!="kadmin/changepw"
    AND NOT (ClientIP="::1" OR ClientIP="127.0.0.1" OR ClientIP="-"), 1, 0)
| eval IsASREPRoasting=if(
    EventCode=4768
    AND (PreAuth="0" OR PreAuth="0x0")
    AND (TicketEncType="0x17" OR TicketEncType="0x18"), 1, 0)
| eval IsGoldenTicketIndicator=if(
    EventCode=4768
    AND (TicketEncType="0x17" OR TicketEncType="0x18")
    AND NOT (ClientIP="::1" OR ClientIP="127.0.0.1" OR ClientIP="-"), 1, 0)
| eval IsKerberosTool=if(
    EventCode=1
    AND match(lower(CommandLine),
      "(rubeus|kerberoast|asreproast|getuserspns|getnpusers|sekurlsa::tickets|kerberos::golden|kerberos::silver|kerberos::ptt|kirbi|ticketer\.py|tgtdeleg)"), 1, 0)
| eval TotalScore=IsKerberoasting + IsASREPRoasting + IsGoldenTicketIndicator + IsKerberosTool
| where TotalScore > 0
| eval AttackPattern=case(
    IsKerberosTool=1, "Kerberos Attack Tool",
    IsGoldenTicketIndicator=1 AND IsASREPRoasting=0, "Potential Golden Ticket (RC4 TGT)",
    IsASREPRoasting=1, "AS-REP Roasting",
    IsKerberoasting=1, "Kerberoasting",
    true(), "Kerberos Anomaly")
| eval Severity=case(
    IsKerberosTool=1 OR (IsGoldenTicketIndicator=1 AND IsASREPRoasting=0), "Critical",
    IsASREPRoasting=1 OR IsKerberoasting=1, "High",
    true(), "Medium")
| table _time, host, ActName, ClientIP, SvcName, TicketEncType, PreAuth, EventCode, AttackPattern, Severity, CommandLine
| sort - _time

sequence by host.name with maxspan=1h
  [authentication where event.code in ("4768", "4769") and
   winlog.event_data.TicketEncryptionType in ("0x17", "0x18") and
   not winlog.event_data.ServiceName like~ "*$" and
   not winlog.event_data.ServiceName in~ ("krbtgt", "kadmin/changepw") and
   not source.ip in ("::1", "127.0.0.1", "-")]
  [authentication where event.code in ("4768", "4769") and
   winlog.event_data.TicketEncryptionType in ("0x17", "0x18")]

OR

sequence by host.name with maxspan=5m
  [process where event.type == "start" and
   (
     process.name in~ ("Rubeus.exe", "Kekeo.exe") or
     process.command_line like~ "*Rubeus*" or
     process.command_line like~ "*kerberoast*" or
     process.command_line like~ "*asreproast*" or
     process.command_line like~ "*GetUserSPNs*" or
     process.command_line like~ "*GetNPUsers*" or
     process.command_line like~ "*sekurlsa::tickets*" or
     process.command_line like~ "*kerberos::golden*" or
     process.command_line like~ "*kerberos::silver*" or
     process.command_line like~ "*kerberos::ptt*" or
     process.command_line like~ "*.kirbi*" or
     process.command_line like~ "*ticketer.py*" or
     process.command_line like~ "*tgtdeleg*"
   )
  ]

-- Pattern 1: Kerberoasting — RC4 TGS requests
SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  logsourceid,
  LOGSOURCENAME(logsourceid) AS LogSource,
  sourceip AS ClientIP,
  username AS AccountName,
  QIDNAME(qid) AS EventName,
  devicestring AS ServiceName,
  "Kerberoasting" AS AttackPattern,
  "Critical" AS Severity
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) = 12
  AND QIDNAME(qid) LIKE '%4769%'
  AND devicestring NOT LIKE '%$'
  AND devicestring NOT IN ('krbtgt', 'kadmin/changepw')
  AND sourceip NOT IN ('127.0.0.1', '::1', '-')
  AND LONG(categoryname(highlevelcategory)) > 0
  AND UTF8(databytes) LIKE '%0x17%'
  AND starttime > (CURRENT_TIMESTAMP - 86400000)

UNION ALL

-- Pattern 2: AS-REP Roasting — Pre-auth disabled TGT
SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  logsourceid,
  LOGSOURCENAME(logsourceid) AS LogSource,
  sourceip AS ClientIP,
  username AS AccountName,
  QIDNAME(qid) AS EventName,
  devicestring AS ServiceName,
  'AS-REP Roasting' AS AttackPattern,
  'High' AS Severity
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) = 12
  AND QIDNAME(qid) LIKE '%4768%'
  AND UTF8(databytes) LIKE '%Pre-Authentication Type:%0%'
  AND (UTF8(databytes) LIKE '%0x17%' OR UTF8(databytes) LIKE '%0x18%')
  AND sourceip NOT IN ('127.0.0.1', '::1', '-')
  AND starttime > (CURRENT_TIMESTAMP - 86400000)

UNION ALL

-- Pattern 3: Kerberos attack tool process execution (Sysmon Event ID 1)
SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  logsourceid,
  LOGSOURCENAME(logsourceid) AS LogSource,
  sourceip AS ClientIP,
  username AS AccountName,
  QIDNAME(qid) AS EventName,
  UTF8(databytes) AS CommandLine,
  'Kerberos Attack Tool' AS AttackPattern,
  'Critical' AS Severity
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) = 12
  AND QIDNAME(qid) LIKE '%1%'
  AND (
    LOWER(UTF8(databytes)) LIKE '%rubeus%'
    OR LOWER(UTF8(databytes)) LIKE '%kerberoast%'
    OR LOWER(UTF8(databytes)) LIKE '%asreproast%'
    OR LOWER(UTF8(databytes)) LIKE '%getuserspns%'
    OR LOWER(UTF8(databytes)) LIKE '%getnpusers%'
    OR LOWER(UTF8(databytes)) LIKE '%sekurlsa::tickets%'
    OR LOWER(UTF8(databytes)) LIKE '%kerberos::golden%'
    OR LOWER(UTF8(databytes)) LIKE '%kerberos::silver%'
    OR LOWER(UTF8(databytes)) LIKE '%kerberos::ptt%'
    OR LOWER(UTF8(databytes)) LIKE '%.kirbi%'
    OR LOWER(UTF8(databytes)) LIKE '%ticketer.py%'
    OR LOWER(UTF8(databytes)) LIKE '%tgtdeleg%'
  )
  AND starttime > (CURRENT_TIMESTAMP - 86400000)
ORDER BY EventTime DESC

// T1558: Steal or Forge Kerberos Tickets — Sumo Logic CSE
// Source: Windows Security Event Log + Sysmon

(_sourceCategory="*WinEventLog*" OR _sourceCategory="*windows*security*" OR _sourceCategory="*sysmon*")
| where EventCode in ("4768", "4769", "4771") or (EventCode = "1" and (
    CommandLine matches "(?i).*rubeus.*" or
    CommandLine matches "(?i).*kerberoast.*" or
    CommandLine matches "(?i).*asreproast.*" or
    CommandLine matches "(?i).*getuserspns.*" or
    CommandLine matches "(?i).*getnpusers.*" or
    CommandLine matches "(?i).*sekurlsa::tickets.*" or
    CommandLine matches "(?i).*kerberos::golden.*" or
    CommandLine matches "(?i).*kerberos::silver.*" or
    CommandLine matches "(?i).*kerberos::ptt.*" or
    CommandLine matches "(?i).*\.kirbi.*" or
    CommandLine matches "(?i).*ticketer\.py.*" or
    CommandLine matches "(?i).*tgtdeleg.*"
  )
)
| parse field=Message "Ticket Encryption Type:\t*" as TicketEncType nodrop
| parse field=Message "Service Name:\t*" as ServiceName nodrop
| parse field=Message "Pre-Authentication Type:\t*" as PreAuthType nodrop
| parse field=Message "Client Address:\t*" as ClientIP nodrop
| parse field=Message "Account Name:\t*" as AccountName nodrop
| if(isEmpty(ClientIP), src_ip, ClientIP) as ClientIP
| if(isEmpty(AccountName), user, AccountName) as AccountName
// Score each event
| eval IsKerberoasting = if(
    EventCode = "4769"
    and (TicketEncType = "0x17" or TicketEncType = "0x18")
    and !(ServiceName matches ".*\$")
    and !(ServiceName in ("krbtgt","kadmin/changepw"))
    and !(ClientIP in ("::1","127.0.0.1","-")),
    1, 0)
| eval IsASREPRoasting = if(
    EventCode = "4768"
    and (PreAuthType = "0" or PreAuthType = "0x0")
    and (TicketEncType = "0x17" or TicketEncType = "0x18"),
    1, 0)
| eval IsGoldenTicket = if(
    EventCode = "4768"
    and (TicketEncType = "0x17" or TicketEncType = "0x18")
    and !(ClientIP in ("::1","127.0.0.1","-")),
    1, 0)
| eval IsKerberosTool = if(EventCode = "1", 1, 0)
| eval TotalScore = IsKerberoasting + IsASREPRoasting + IsGoldenTicket + IsKerberosTool
| where TotalScore > 0
| eval AttackPattern = if(IsKerberosTool = 1, "Kerberos Attack Tool",
    if(IsGoldenTicket = 1 and IsASREPRoasting = 0, "Potential Golden Ticket (RC4 TGT)",
    if(IsASREPRoasting = 1, "AS-REP Roasting",
    if(IsKerberoasting = 1, "Kerberoasting", "Kerberos Anomaly"))))
| eval Severity = if(IsKerberosTool = 1 or (IsGoldenTicket = 1 and IsASREPRoasting = 0), "Critical",
    if(IsASREPRoasting = 1 or IsKerberoasting = 1, "High", "Medium"))
| fields _messageTime, _sourceHost, AccountName, ClientIP, ServiceName, TicketEncType, PreAuthType, EventCode, AttackPattern, Severity, CommandLine
| sort by _messageTime desc

rule t1558_steal_forge_kerberos_tickets {
  meta:
    author = "Detection Engineering"
    description = "Detects T1558 Steal or Forge Kerberos Tickets: Kerberoasting, AS-REP Roasting, Golden Ticket, and Kerberos attack tool execution"
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "T1558"
    mitre_attack_sub_techniques = "T1558.001, T1558.002, T1558.003, T1558.004"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://attack.mitre.org/techniques/T1558/"
    created = "2026-01-01"
    version = "1.0"

  events:
    (
      // Pattern 1 & 2 & 3: Kerberos protocol anomalies (4768/4769)
      $e.metadata.event_type = "USER_RESOURCE_ACCESS"
      and $e.metadata.product_event_type in ("4768", "4769")
      and (
        // Kerberoasting: RC4 TGS request for service account
        (
          $e.metadata.product_event_type = "4769"
          and $e.target.resource.attribute.labels["ticket_encryption_type"] in ("0x17", "0x18")
          and not re.regex($e.target.resource.name, `.*\$$`)
          and not $e.target.resource.name in ("krbtgt", "kadmin/changepw")
          and not $e.principal.ip in ("::1", "127.0.0.1", "-")
        )
        or
        // AS-REP Roasting: Pre-auth disabled TGT
        (
          $e.metadata.product_event_type = "4768"
          and $e.target.resource.attribute.labels["pre_authentication_type"] = "0"
          and $e.target.resource.attribute.labels["ticket_encryption_type"] in ("0x17", "0x18")
        )
        or
        // Golden Ticket indicator: RC4 TGT in AES-enforced domain
        (
          $e.metadata.product_event_type = "4768"
          and $e.target.resource.attribute.labels["ticket_encryption_type"] in ("0x17", "0x18")
          and not $e.principal.ip in ("::1", "127.0.0.1", "-")
        )
      )
    )
    or
    (
      // Pattern 4: Kerberos attack tool process execution
      $e.metadata.event_type = "PROCESS_LAUNCH"
      and (
        re.regex($e.target.process.command_line, `(?i)(rubeus|kerberoast|asreproast|getuserspns|getnpusers|sekurlsa::tickets|kerberos::golden|kerberos::silver|kerberos::ptt|\.kirbi|ticketer\.py|tgtdeleg|kekeo)`)
        or $e.target.process.file.full_path matches "/(?i)(rubeus\.exe|kekeo\.exe)$/"
      )
    )

  condition:
    $e
}

// T1558: Steal or Forge Kerberos Tickets — CrowdStrike LogScale (Falcon CQL)
// Pattern 1 & 2: Kerberos protocol anomalies via Windows Security Event telemetry
// (Requires Windows Security Event log collection enabled in Falcon sensor)

#event_simpleName = "WindowsSecurityEvent"
| EventCode in (4768, 4769)
| TicketEncryptionType in ("0x17", "0x18")
| (
    // Kerberoasting: RC4 service ticket for non-machine account
    (
      EventCode = 4769
      | ServiceName != /.*\$$/
      | ServiceName != /^(krbtgt|kadmin\/changepw)$/i
      | ClientAddress != /^(::1|127\.0\.0\.1|-)$/
      | Status = "0x0"
      | AttackPattern := "Kerberoasting"
      | Severity := "Critical"
    )
    or
    // AS-REP Roasting: pre-auth disabled TGT
    (
      EventCode = 4768
      | PreAuthType in ("0", "0x0")
      | AttackPattern := "AS-REP Roasting"
      | Severity := "High"
    )
    or
    // Golden Ticket indicator: RC4 TGT
    (
      EventCode = 4768
      | ClientAddress != /^(::1|127\.0\.0\.1|-)$/
      | AttackPattern := "Potential Golden Ticket (RC4 TGT)"
      | Severity := "Critical"
    )
  )
| table([timestamp, ComputerName, TargetUserName, ClientAddress, ServiceName, TicketEncryptionType, PreAuthType, EventCode, AttackPattern, Severity])

// Pattern 3: Kerberos attack tool process execution via Falcon EDR
| union {
    #event_simpleName = ProcessRollup2
    | CommandLine = /(?i)(rubeus|kerberoast|asreproast|getuserspns|getnpusers|sekurlsa::tickets|kerberos::golden|kerberos::silver|kerberos::ptt|\.kirbi|ticketer\.py|tgtdeleg|kekeo)/
        OR ImageFileName = /(?i)(rubeus\.exe|kekeo\.exe)$/
    | AttackPattern := "Kerberos Attack Tool"
    | Severity := "Critical"
    | table([timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, AttackPattern, Severity])
  }
| sort(timestamp, order=desc)