LDAP Search followed by Kerberos Connection

[rule]
description = """
Identifies Ldap search followed by a network connections to the standard Kerberos port from an unusual process. On
Windows, the only native system process that normally performs Kerberos traffic from a domain joined host is lsass.exe.
"""
id = "53e680ea-89b7-474a-ac10-089adcd02f13"
license = "Elastic License v2"
name = "LDAP Search followed by Kerberos Connection"
os_list = ["windows"]
version = "1.0.1"

query = '''
sequence by process.entity_id with maxspan=1m
 [api where process.Ext.api.name == "ldap_search" and
  not (user.id == "S-1-5-18" and process.executable : "?:\\Windows\\System32\\lsass.exe") and
  not (process.executable : "C:\\Program Files\\*\\Server\\bin\\ws_TomcatService.exe" and
       process.code_signature.subject_name in ("VMware, Inc.", "Omnissa, LLC") and process.code_signature.trusted == true) and
  not (process.executable : "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" and
       process.parent.executable : "C:\\Windows\\System32\\svchost.exe" and process.Ext.api.parameters.search_filter in ("(cn=rid manager$)", "(cn=krbtgt)")) and 
  not (process.executable : "C:\\Program Files\\Microsoft Office\\root\\Office16\\WINWORD.EXE" and process.Ext.api.parameters.search_filter like "(|(mail=*)(proxyAddresses=smtp:*))")
  ]
 [network where destination.port == 88 and source.port >= 49152 and network.direction == "egress" and
  network.transport == "tcp" and not destination.address : ("127.*", "::1")]
'''

min_endpoint_version = "9.1.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1558"
name = "Steal or Forge Kerberos Tickets"
reference = "https://attack.mitre.org/techniques/T1558/"


[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "9.1.0"