SKsarthak.kc

~/sarthak/case

ONE ALERT

A sample Kerberoasting alert, handled the way I work a real one. Scroll to play it.

sample data, made up for this page

  1. 01 detect
  2. 02 correlate
  3. 03 triage
  4. 04 respond
siem://case-0412sev: low

02:14:07 event 4769 > service ticket requested

acct=svc_sql enc=0x17(rc4) host=ws-114.example.local

02:15:02 rule kerberoast-rc4 matched

rc4 ticket for an aes capable account

02:31:40 verdict: TRUE POSITIVE

same host, 37 tgs requests, 1 hour

02:41:11 escalated to client

reset svc_sql / disable rc4 / hunt for reuse

  1. 01 detect

    Event 4769 asks for a Kerberos ticket with RC4, an old cipher.

  2. 02 correlate

    My rule flags RC4 tickets for accounts that support AES.

  3. 03 triage

    A burst of ticket requests from one host: real Kerberoasting.

  4. 04 respond

    Escalated with a clear fix: reset the account, disable RC4, hunt for reuse.