Kerberos Network Traffic RC4 Ticket Encryption

Title: Kerberos Network Traffic RC4 Ticket Encryption
Status: test
Description:Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting
References:
  -https://adsecurity.org/?p=3458
Author: sigma
Date: 2020-02-12
modified:2021-11-27
Tags:

• -'attack.credential-access'
• -'attack.t1558.003'

Logsource:

• product: zeek
• service: kerberos

Detection:
  selection:
    request_type: 'TGS'
    cipher: 'rc4-hmac'
  computer_acct:
    service|startswith: '$'
  condition:selection and not computer_acct
Falsepositives:
  -Normal enterprise SPN requests activity
Level: medium