Windows: Alert on Suspicious Kerberos TGT Requests with Certificate Thumbprints (Event ID 4768)

Identifies unusual certificate-associated Kerberos TGT (4768) requests targeting computer accounts on Windows.

FreeUnreviewedSigmahighv1

windows-alert-on-suspicious-kerberos-tgt-requests-with-certificate-thumbprints-e-6a53d871

title: "Windows: Alert on Suspicious Kerberos TGT Requests with Certificate Thumbprints (Event ID 4768)"
id: 823d7a47-9ce3-4651-989c-1998c4ee6b56
status: test
description: This rule flags Windows Security events (EventID 4768) where a Kerberos Ticket Granting Ticket is requested and the request contains a certificate thumbprint while the TargetUserName ends with '$' (computer account). Certificate-backed TGT requests can indicate abuse of directory services and PKI flows to obtain Kerberos credentials for further activity. The detection relies on detailed fields in the 4768 event, including TargetUserName, CertThumbprint, and excludes empty thumbprints and local traffic.
references:
  - https://github.com/topotam/PetitPotam
  - https://isc.sans.edu/forums/diary/Active+Directory+Certificate+Services+ADCS+PKI+domain+admin+vulnerability/27668/
  - https://github.com/splunk/security_content/blob/88d689fe8a055d8284337b9fad5d9152b42043db/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_petitpotam_susp_tgt_request.yml
author: Mauricio Velazco, Michael Haag, Huntrule Team
date: 2021-09-02
modified: 2022-10-05
tags:
  - attack.credential-access
  - attack.t1187
logsource:
  product: windows
  service: security
  definition: The advanced audit policy setting "Account Logon > Kerberos Authentication Service" must be configured for Success/Failure
detection:
  selection:
    EventID: 4768
    TargetUserName|endswith: $
    CertThumbprint|contains: "*"
  filter_local:
    IpAddress: ::1
  filter_thumbprint:
    CertThumbprint: ""
  condition: selection and not 1 of filter_*
falsepositives:
  - False positives are possible if the environment is using certificates for authentication. We recommend filtering Account_Name to the Domain Controller computer accounts.
level: high
license: DRL-1.1
related:
  - id: 6a53d871-682d-40b6-83e0-b7c1a6c4e3a5
    type: derived

What it detects

This rule flags Windows Security events (EventID 4768) where a Kerberos Ticket Granting Ticket is requested and the request contains a certificate thumbprint while the TargetUserName ends with '$' (computer account). Certificate-backed TGT requests can indicate abuse of directory services and PKI flows to obtain Kerberos credentials for further activity. The detection relies on detailed fields in the 4768 event, including TargetUserName, CertThumbprint, and excludes empty thumbprints and local traffic.

Known false positives

False positives are possible if the environment is using certificates for authentication. We recommend filtering Account_Name to the Domain Controller computer accounts.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.