Silverfort - Kerberoasting | Microsoft Sentinel Analytic Rules

Back


Id	e8e921df-1954-5d9e-bfc9-56df5628208c
Rulename	Silverfort - Kerberoasting
Description	Identifies Silverfort incidents involving requests for weakly encrypted service tickets. This behavior may indicate service principal name ticket harvesting for offline password cracking.
Severity	High
Tactics	CredentialAccess
Techniques	T1558.003
Required data connectors	SilverfortAma
Kind	Scheduled
Query frequency	15m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Silverfort/Analytic%20Rules/Kerberoasting.yaml
Version	1.0.0
Arm template	e8e921df-1954-5d9e-bfc9-56df5628208c.json

KQL

CommonSecurityLog
| where DeviceVendor has 'Silverfort'
| where DeviceProduct has 'Admin Console'
| where DeviceEventClassID == "NewIncident"
| where Message has "Kerberoasting"
| extend IncidentData = parse_json(replace('^""|""$', '', Message))
| extend IncidentKind = coalesce(tostring(IncidentData.data.kind), tostring(IncidentData.kind))
| extend IncidentId = tostring(coalesce(IncidentData.data.id, IncidentData.id))
| extend IncidentSummary = tostring(coalesce(IncidentData.data.summary, IncidentData.summary))
| extend UserName = coalesce(
    tostring(IncidentData.data.users[0].samAccountName),
    tostring(IncidentData.data.users[0].upn),
    tostring(IncidentData.data.users[0].displayName),
    tostring(IncidentData.users[0].displayName)
)
| extend SourceHost = coalesce(
    tostring(IncidentData.data.sources[0].displayName),
    tostring(IncidentData.sources[0].displayName)
)
| extend DestinationHost = coalesce(
    tostring(IncidentData.data.destinations[0].displayName),
    tostring(IncidentData.destinations[0].displayName)
)

YAML

triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Silverfort/Analytic%20Rules/Kerberoasting.yaml
status: Available
query: |-
  CommonSecurityLog
  | where DeviceVendor has 'Silverfort'
  | where DeviceProduct has 'Admin Console'
  | where DeviceEventClassID == "NewIncident"
  | where Message has "Kerberoasting"
  | extend IncidentData = parse_json(replace('^""|""$', '', Message))
  | extend IncidentKind = coalesce(tostring(IncidentData.data.kind), tostring(IncidentData.kind))
  | extend IncidentId = tostring(coalesce(IncidentData.data.id, IncidentData.id))
  | extend IncidentSummary = tostring(coalesce(IncidentData.data.summary, IncidentData.summary))
  | extend UserName = coalesce(
      tostring(IncidentData.data.users[0].samAccountName),
      tostring(IncidentData.data.users[0].upn),
      tostring(IncidentData.data.users[0].displayName),
      tostring(IncidentData.users[0].displayName)
  )
  | extend SourceHost = coalesce(
      tostring(IncidentData.data.sources[0].displayName),
      tostring(IncidentData.sources[0].displayName)
  )
  | extend DestinationHost = coalesce(
      tostring(IncidentData.data.destinations[0].displayName),
      tostring(IncidentData.destinations[0].displayName)
  )
kind: Scheduled
relevantTechniques:
- T1558.003
version: 1.0.0
tactics:
- CredentialAccess
id: e8e921df-1954-5d9e-bfc9-56df5628208c
queryPeriod: 15m
queryFrequency: 15m
severity: High
name: Silverfort - Kerberoasting
customDetails:
  IncidentReference: IncidentId
  IncidentSummary: IncidentSummary
  IncidentKind: IncidentKind
requiredDataConnectors:
- connectorId: SilverfortAma
  dataTypes:
  - CommonSecurityLog
description: |
  Identifies Silverfort incidents involving requests for weakly encrypted service tickets. This behavior may indicate service principal name ticket harvesting for offline password cracking.
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: UserName
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: SourceHost
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: DestinationHost
triggerThreshold: 0

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/e8e921df-1954-5d9e-bfc9-56df5628208c')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/e8e921df-1954-5d9e-bfc9-56df5628208c')]",
      "properties": {
        "alertRuleTemplateName": "e8e921df-1954-5d9e-bfc9-56df5628208c",
        "customDetails": {
          "IncidentKind": "IncidentKind",
          "IncidentReference": "IncidentId",
          "IncidentSummary": "IncidentSummary"
        },
        "description": "Identifies Silverfort incidents involving requests for weakly encrypted service tickets. This behavior may indicate service principal name ticket harvesting for offline password cracking.\n",
        "displayName": "Silverfort - Kerberoasting",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "UserName",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "SourceHost",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "DestinationHost",
                "identifier": "HostName"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Silverfort/Analytic%20Rules/Kerberoasting.yaml",
        "query": "CommonSecurityLog\n| where DeviceVendor has 'Silverfort'\n| where DeviceProduct has 'Admin Console'\n| where DeviceEventClassID == \"NewIncident\"\n| where Message has \"Kerberoasting\"\n| extend IncidentData = parse_json(replace('^\"\"|\"\"$', '', Message))\n| extend IncidentKind = coalesce(tostring(IncidentData.data.kind), tostring(IncidentData.kind))\n| extend IncidentId = tostring(coalesce(IncidentData.data.id, IncidentData.id))\n| extend IncidentSummary = tostring(coalesce(IncidentData.data.summary, IncidentData.summary))\n| extend UserName = coalesce(\n    tostring(IncidentData.data.users[0].samAccountName),\n    tostring(IncidentData.data.users[0].upn),\n    tostring(IncidentData.data.users[0].displayName),\n    tostring(IncidentData.users[0].displayName)\n)\n| extend SourceHost = coalesce(\n    tostring(IncidentData.data.sources[0].displayName),\n    tostring(IncidentData.sources[0].displayName)\n)\n| extend DestinationHost = coalesce(\n    tostring(IncidentData.data.destinations[0].displayName),\n    tostring(IncidentData.destinations[0].displayName)\n)",
        "queryFrequency": "PT15M",
        "queryPeriod": "PT15M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [
          "T1558.003"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess"
        ],
        "techniques": [
          "T1558"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}