Uncommon Outbound Kerberos Port 88 Connections on Windows Security Events 5156

Alerts on rare outbound Kerberos (port 88) connections from non-browser/non-lsass processes using Windows Event 5156.

FreeUnreviewedSigmamediumv1

uncommon-outbound-kerberos-port-88-connections-on-windows-security-events-5156-eca91c7c

title: Uncommon Outbound Kerberos Port 88 Connections on Windows Security Events 5156
id: bc013751-e853-4e41-ae11-3c01ade3ef61
related:
  - id: e54979bd-c5f9-4d6c-967b-a04b19ac4c74
    type: similar
  - id: eca91c7c-9214-47b9-b4c5-cb1d7e4f2350
    type: derived
status: test
description: This rule flags Windows Security EventID 5156 records where an outbound connection targets destination port 88 (Kerberos). It highlights potentially unusual Kerberos traffic that could indicate attacker activity such as lateral movement or delegated credential abuse. The detection relies on Windows network connection telemetry (Event 5156) and filters to reduce known benign initiators like lsass.exe and common browser processes, based on the recorded Application path.
references:
  - https://github.com/GhostPack/Rubeus
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_outbound_kerberos_connection.yml
author: Ilyas Ochkov, oscd.community, Huntrule Team
date: 2019-10-24
modified: 2024-03-15
tags:
  - attack.lateral-movement
  - attack.credential-access
  - attack.t1558.003
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5156
    DestPort: 88
  filter_main_lsass:
    Application|startswith:
      - \device\harddiskvolume
      - "C:"
    Application|endswith: \Windows\System32\lsass.exe
  filter_optional_chrome:
    Application|startswith:
      - \device\harddiskvolume
      - "C:"
    Application|endswith:
      - \Program Files (x86)\Google\Chrome\Application\chrome.exe
      - \Program Files\Google\Chrome\Application\chrome.exe
  filter_optional_firefox:
    Application|startswith:
      - \device\harddiskvolume
      - "C:"
    Application|endswith:
      - \Program Files (x86)\Mozilla Firefox\firefox.exe
      - \Program Files\Mozilla Firefox\firefox.exe
  filter_optional_tomcat:
    Application|endswith: \tomcat\bin\tomcat8.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Web Browsers and third party application might generate similar activity. An initial baseline is required.
level: medium
license: DRL-1.1

What it detects

This rule flags Windows Security EventID 5156 records where an outbound connection targets destination port 88 (Kerberos). It highlights potentially unusual Kerberos traffic that could indicate attacker activity such as lateral movement or delegated credential abuse. The detection relies on Windows network connection telemetry (Event 5156) and filters to reduce known benign initiators like lsass.exe and common browser processes, based on the recorded Application path.

Known false positives

Web Browsers and third party application might generate similar activity. An initial baseline is required.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.