Kerberos attacks
Nf Ttp Generic Kerberos Attacks
Query
DeviceProcessEvents
| where ProcessCommandLine has_any ('ptt /ticket', ' monitor /interval', ' asktgt', ' asktgs', ' golden', ' silver', ' kerberoast', ' asreproast', ' renew', ' brute')
| project Timestamp, AccountName, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLineAbout this query
Explanation
The query is looking for potential Kerberos attacks. It checks for specific alerts related to successful logon using stolen credentials and command line usage for overpass-the-hash. It also looks for potential lateral movement paths identified in IdentityDirectoryEvents and common Mimikatz and Rubeus command lines in DeviceProcessEvents.
Details
Bert-Jan Pals
Released: February 1, 2024
Tables
AlertInfoIdentityDirectoryEventsDeviceProcessEvents
Keywords
DevicesIntuneUser
Operators
has_anywhereTitleAlertInfoProjectTimestampActionTypeApplicationAccountNameAccountDomainAccountSidAccountDisplayNameDeviceNameAdditionalFieldsProcessCommandLineDeviceProcessEventsIdentityDirectoryEventssekurlsa::tickets /exportkerberos::pttptt /ticketmonitor /intervalasktgtasktgsgoldensilverkerberoastasreproastrenewbrute