Uncommon Outbound Kerberos (TCP/88) Connection on Windows

title: Uncommon Outbound Kerberos (TCP/88) Connection on Windows
id: a154412d-766c-4cb9-bee2-3c017033e1d6
related:
  - id: eca91c7c-9214-47b9-b4c5-cb1d7e4f2350
    type: similar
  - id: e54979bd-c5f9-4d6c-967b-a04b19ac4c74
    type: derived
status: test
description: This rule flags outbound network connections to destination port 88 (Kerberos) that are initiated by processes whose image paths are not lsass.exe and not a set of common browser or Tomcat executables. Kerberos traffic to atypical destinations can indicate suspicious authentication activity, including lateral movement and delegation-related abuse. Telemetry relies on Windows network connection events with fields for destination port and the initiating process image path, including an initiated flag.
references:
  - https://github.com/GhostPack/Rubeus
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_susp_outbound_kerberos_connection.yml
author: Ilyas Ochkov, oscd.community, Huntrule Team
date: 2019-10-24
modified: 2024-03-15
tags:
  - attack.credential-access
  - attack.t1558
  - attack.lateral-movement
  - attack.t1550.003
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 88
    Initiated: "true"
  filter_main_lsass:
    Image: C:\Windows\System32\lsass.exe
  filter_optional_chrome:
    Image:
      - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      - C:\Program Files\Google\Chrome\Application\chrome.exe
  filter_optional_firefox:
    Image:
      - C:\Program Files (x86)\Mozilla Firefox\firefox.exe
      - C:\Program Files\Mozilla Firefox\firefox.exe
  filter_optional_tomcat:
    Image|endswith: \tomcat\bin\tomcat8.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Web Browsers and third party application might generate similar activity. An initial baseline is required.
level: medium
license: DRL-1.1