Suspicious Kerberos Service Ticket Request

Description

The following analytic detects suspicious Kerberos Service Ticket (TGS) requests where the requesting account name matches the service name, potentially indicating an exploitation attempt of CVE-2021-42278 and CVE-2021-42287. This detection leverages Event ID 4769 from Domain Controller and Kerberos events. Such activity is significant as it may represent an adversary attempting to escalate privileges by impersonating a domain controller. If confirmed malicious, this could allow an attacker to take control of the domain controller, leading to complete domain compromise and unauthorized access to sensitive information.

Query · spl

`wineventlog_security` EventCode=4769
  | eval isSuspicious = if(lower(ServiceName) = lower(mvindex(split(TargetUserName,"@"),0)),1,0)
  | where isSuspicious = 1
  | rename Computer as dest
  | rename TargetUserName as user
  | table _time, dest, src_ip, user, ServiceName, Error_Code, isSuspicious
  | `suspicious_kerberos_service_ticket_request_filter`

Implementation guide

To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting Audit Kerberos Authentication Service within Account Logon needs to be enabled.

Known false positives

  • We have tested this detection logic with ~2 million 4769 events and did not identify false positives. However, they may be possible in certain environments. Filter as needed.

Analyst notes

Known false positives: We have tested this detection logic with ~2 million 4769 events and did not identify false positives. However, they may be possible in certain environments. Filter as needed.

Raw source Suspicious Kerberos Service Ticket Request · SPL
Esc
Published by splunk/security_content ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
name: Suspicious Kerberos Service Ticket Request
id: 8b1297bc-6204-11ec-b7c4-acde48001122
version: 12
creation_date: '2021-12-20'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects suspicious Kerberos Service Ticket (TGS) requests where the requesting account name matches the service name, potentially indicating an exploitation attempt of CVE-2021-42278 and CVE-2021-42287. This detection leverages Event ID 4769 from Domain Controller and Kerberos events. Such activity is significant as it may represent an adversary attempting to escalate privileges by impersonating a domain controller. If confirmed malicious, this could allow an attacker to take control of the domain controller, leading to complete domain compromise and unauthorized access to sensitive information.
data_source:
    - Windows Event Log Security 4769
search: |-
    `wineventlog_security` EventCode=4769
      | eval isSuspicious = if(lower(ServiceName) = lower(mvindex(split(TargetUserName,"@"),0)),1,0)
      | where isSuspicious = 1
      | rename Computer as dest
      | rename TargetUserName as user
      | table _time, dest, src_ip, user, ServiceName, Error_Code, isSuspicious
      | `suspicious_kerberos_service_ticket_request_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
known_false_positives: We have tested this detection logic with ~2 million 4769 events and did not identify false positives. However, they may be possible in certain environments. Filter as needed.
references:
    - https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287
    - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-sfu/02636893-7a1f-4357-af9a-b672e3e3de13
drilldown_searches:
    - name: View the detection results for - "$dest$"
      search: '%original_detection_search% | search  dest = "$dest$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$dest$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: 7d
      latest_offset: "0"
finding:
    title: A suspicious Kerberos Service Ticket was requested by $user$ on host $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - sAMAccountName Spoofing and Domain Controller Impersonation
    - Active Directory Kerberos Attacks
    - Active Directory Privilege Escalation
asset_type: Endpoint
cve:
    - CVE-2021-42287
    - CVE-2021-42278
mitre_attack_id:
    - T1078.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/suspicious_kerberos_service_ticket_request/windows-xml.log
          source: XmlWinEventLog:Security
          sourcetype: XmlWinEventLog
      test_type: unit

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.