[rule]
description = """
Identifies an untrusted or unsigned process accessing the Kerberos configuration file. Adversaries may attempt to access
this file in order to gain situational awareness regarding the Active Directory domain to include its structure and
settings.
"""
id = "143a7c98-62d3-4294-b660-6a98ae0a477c"
license = "Elastic License v2"
name = "Kerberos Config File Accessed by Untrusted or Unsigned Process"
os_list = ["macos"]
version = "1.0.5"
query = '''
file where event.action == "open" and
file.path like "/etc/krb5.conf" and
(process.code_signature.trusted == false or process.code_signature.exists == false)
'''
min_endpoint_version = "8.11.1"
optional_actions = []
[[actions]]
action = "kill_process"
field = "Effective_process.executable"
state = 0
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1649"
name = "Steal or Forge Authentication Certificates"
reference = "https://attack.mitre.org/techniques/T1649/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "8.11.1"