Using stolen or forged user tickets (TGT)

[Dustem]

hi guys, I want to detect a service ticket request (Windows event code 4769) and one of the following corresponding events does not appear before the service ticket request:
1. User Ticket (TGT) request, Windows event code 4768.
2. Ticket renewal request, Windows event code 4770.

[Dustem]

I want to search for a user with 4769 events over a continuous period, but the user has no 4768 or 4770 events during that time, instead of 4769 and no 4768 or 4770 users.

[Dustem]

Not during this period, but the user did not have 4768 or 4770 events prior to this period.

[gcusello]

Hi @Dustem,

let me understand: 4768 or 4770 should be before the 4769 and you want an alert if tey are missing or tey aren't before, is is correct?

Ciao.

Giuseppe

[gcusello]

Hi @Dustem,

let me understand: you want to discover if, in one time period, there was a Windows EventCode=4769 but not a Windows EventCode=4770, is it correct?

I suppose that you have a common ID to correlate the events.

If this is your requirement, you could try something like this:

index=wineventlog EventCode IN (4769,4770)
| stats dc(EventCode) AS EventCode_count BY TGT_Id
| where EventCode_count=1

Cioao.

Giuseppe

[Dustem]

Hi gcusello,

My description may not be accurate.

I want to detect eventcode=4769 and  then detect whether the user of this event(eventcode=4769) has eventcode=4768 or eventcode=4770 before it.

[gcusello]

Hi @Dustem,

the approach is the same:

index=wineventlog EventCode IN (4768,4769,4770)
| stats 
   dc(EventCode) AS EventCode_count 
   values(EventCode) AS EventCode 
   BY user
| where EventCode_count=1 AND EventCode=4769

in this way you have the users where there's the EventCode 4769 but not one of the others.

Ciao.

Giuseppe