KQL Search

This query is designed to detect potential Kerberos ticket attacks, specifically "Kerberos Roasting," by analyzing logon events. Here's a simple breakdown of what it does:

1. Whitelist Setup: It defines a whitelist of VIP accounts that should be ignored in the detection. In this case, the account "[email protected]" is whitelisted.

2. Data Source: It uses the IdentityLogonEvents table to find relevant logon events.

3. Time Filter: It only considers events that occurred within the last hour.

4. Protocol Filter: It focuses on events where the Kerberos protocol was used.

5. Attack Technique Detection: It checks if the event's additional fields indicate the use of the attack technique "T1558.003," which is associated with Kerberos Roasting.

6. Encryption Type Filter: It further filters events to those using the "rc4hmac" encryption type, which is commonly targeted in Kerberos Roasting attacks.

7. Service Principal Names (SPNs) Extraction: It extracts the SPNs involved in the event.

8. Summarization: It counts the distinct SPNs targeted by each user account (AccountUpn).

9. Whitelist Exclusion: It excludes any accounts that are on the whitelist from further consideration.

10. Suspicious Activity Detection: It flags accounts that have targeted more than three distinct SPNs, which could indicate suspicious activity.

In summary, this query is designed to identify potential Kerberos Roasting attacks by looking for unusual patterns in Kerberos logon events, while excluding known safe accounts from the analysis.