Using stolen or forged tickets (TGT)

[Dustem]

Hi guys, I want to detect a service ticket (TGS) request (Windows event code 4769) that is not preceded by one of the following corresponding events:

1. User ticket (TGT) request, Windows event code 4768.

2. Ticket renewal request, Windows event code 4770.

3. Logon event, Windows event code 4624.

The following is the SPL I wrote, but I found that there is a problem, could you help me to modify it? 

index="xx"

| transaction user maxspan=24h maxpause=10h startwith=("Eventcode=4768", "Eventcode=4770", "Eventcode=4624") endswit="Eventcode=4769" keepevicted=true

| search Eventcode=4769 NOT (Eventcode=4768 OR Eventcode=4770 OR Eventcode=4624)

[richgalloway]

What is the problem you are having with that query (other than the spelling errors)?

FWIW, the value of the startswith argument must be a valid SPL search or eval expression.  The current value is neither.

[Dustem]

I want to query the same user only 4769 events in 24h without the other three eventcode (4768, 4770, 4624) events, the SPL doesn't fulfill this requirement.

[richgalloway]

As I suggested, try the original query with a valid expression.

index="xx"

| transaction user maxspan=24h maxpause=10h startswith=("Eventcode=4768" OR "Eventcode=4770" OR "Eventcode=4624") endswith="Eventcode=4769" keepevicted=true

| search Eventcode=4769 NOT (Eventcode=4768 OR Eventcode=4770 OR Eventcode=4624)

[Dustem]

I'm used the SPL you provided but didn't solve it. So I adjusted the SPL, filtered out the same user in a period events, and then filter out Eventcode only 4769 case.

index="xx"

| transaction user maxspan=24h maxpause=10h connected=false

| search NOT Eventcode IN (4768,4770,4624) AND Eventcode=4769

[yuanliu]

I don't think "NOT Eventcode IN (4768,4770,4624) AND Eventcode=4769" is what it takes.  The idea is that those three codes do not precede 4769.  So, you exclude any completed transactions instead.

index="xx"

| transaction user maxspan=24h maxpause=10h startswith="Eventcode IN (4768,4770,4624)"
  endswith="Eventcode=4769" keepevicted=true keeporphaned=true
| where closed_txn==0

[Dustem]

In this case, how do i  continue filter out the events that precede the appearance of 4769 without the other three Eventcodes?

[yuanliu]

If any of the codes, including your initial code, give output that doesn't suit the needs, please post sample data (anonymize as needed) that lead to such output, actual output (anonymize as needed) from such code, and explain what the desired output should look like. (And how the desired output is different from actual output if that is not painfully obvious.)

Your initial code performs transaction on user.  After excluding closed transactions, what remain in the stream are events with eventcode 4769 that do not have those three eventcodes for the same user, as well as events with eventcodes that are not those three.  Isn't this what you ask for?

[Dustem]

hi yuanliu,

Do you have any updates?

We need filter out events where a user has only Eventcode=4776 over a while, and exclude events where 4770 or 4768, or 4624 precede 4776, because we think that this situation is reasonable and that only the presence of 4776 alone is illegal.

[yuanliu]

This is even more confusing.  Are you saying that you need to find users that only have one event code 4766 during the period?  All you need to do is

index="xx"

| stats values(EventCode) as EventCode
| where mvcount(EventCode) == 1 AND EventCode == 4766

[Dustem]

We refer to the golden ticket attack, according to the Kerberos mechanism, a prerequisite for a service ticket request is a user ticket request (or renewal of an existing ticket). When this is not the case and we do not see a corresponding prior login event, the user ticket is suspected to be forged or stolen from another machine.

So the logic of the detection is that one of the following corresponding events does not occur before the service ticket request (Eventcode=4769): 1. user ticket (TGT) request (Eventcode=4768). 2. ticket renewal request (Eventcode=4770). 3. Login event (Eventcode=4624).

[Dustem]

The query needs to be in an intranet environment, so I can't provide it.

I can describe the query result, the results I get from the query based on SPL are only events about 4769, but I again make a new query with the user field as a keyword in the query results, and I will find that there are three other Eventcode records for this user within 24 hours.

So I require that I want the query result to be a user who has only events about 4769 and not three other Eventcodes within 24 hours.