Detection: Unusual Number of Computer Service Tickets Requested

Description

The following analytic identifies an unusual number of computer service ticket requests from a single source, leveraging Event ID 4769, "A Kerberos service ticket was requested." It uses statistical analysis, including standard deviation and the 3-sigma rule, to detect anomalies in service ticket requests. This activity is significant as it may indicate malicious behavior such as lateral movement, malware staging, or reconnaissance. If confirmed malicious, an attacker could gain unauthorized access to multiple endpoints, facilitating further compromise and potential data exfiltration.

Search

1 `wineventlog_security` EventCode=4769 Service_Name="*$" Account_Name!="*$*" 
2| bucket span=2m _time 
3| stats dc(Service_Name) AS unique_targets values(Service_Name) as host_targets by _time, Client_Address, Account_Name 
4| eventstats avg(unique_targets) as comp_avg , stdev(unique_targets) as comp_std by Client_Address, Account_Name 
5| eval upperBound=(comp_avg+comp_std*3) 
6| eval isOutlier=if(unique_targets >10 and unique_targets >= upperBound, 1, 0) 
7| `unusual_number_of_computer_service_tickets_requested_filter`

Data Source

Name	Platform	Sourcetype	Source	Supported App
Windows Event Log Security 4769	Windows	'xmlwineventlog'	'XmlWinEventLog:Security'	N/A

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting Audit Kerberos Authentication Service within Account Logon needs to be enabled.

Known False Positives

An single endpoint requesting a large number of computer service tickets is not common behavior. Possible false positive scenarios include but are not limited to vulnerability scanners, administration systeams and missconfigured systems.

Associated Analytic Story

• Active Directory Kerberos Attacks

• Active Directory Lateral Movement

• Active Directory Privilege Escalation

Risk Based Analytics (RBA)

References

• https://attack.mitre.org/techniques/T1078/

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 2