Windows vulnerable spn enumerated

windows

Classification:

attack

Tactic:

TA0006-credential-access

Technique:

T1558-steal-or-forge-kerberos-tickets

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal

Detects when multiple Service Principle Names (SPN) are requested with weak encryption types. This could be evidence of a kerberoasting attack being conducted

Strategy

Monitoring of Windows event logs where @evt.id is 4769 and grouping by @Event.EventData.Data.TargetUserName.

Triage & Response

Verify if {{@Event.EventData.Data.TargetUserName}} is expected to request multiple SPN’s. If possible, disable usage of weak encryption types such as RC4 for kerberos tickets.