Windows Detects Suspicious Local Kerberos Logon of Built-in Administrator (Potential Privilege Escalation)

title: Windows Detects Suspicious Local Kerberos Logon of Built-in Administrator (Potential Privilege Escalation)
id: a6a8e6cb-a5ba-4ef2-8541-d371acfc602a
status: test
description: This rule flags a successful Windows logon (Event ID 4624) using the Kerberos authentication package with the source IP set to localhost (127.0.0.1). It specifically targets cases where the target user SID matches a domain-style SID prefix (S-1-5-21-*) and ends with -500, which corresponds to the built-in local Administrator account. Such patterns may indicate an attempt to perform a local Kerberos relay variant to escalate privileges from a limited domain-joined context. The detection relies on Security log telemetry fields including LogonType, AuthenticationPackageName, IpAddress, and TargetUserSid.
references:
  - https://twitter.com/sbousseaden/status/1518976397364056071?s=12&t=qKO5eKHvWhAP19a50FTZ7g
  - https://github.com/elastic/detection-rules/blob/5fe7833312031a4787e07893e27e4ea7a7665745/rules/_deprecated/privilege_escalation_krbrelayup_suspicious_logon.toml#L38
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_susp_privesc_kerberos_relay_over_ldap.yml
author: Elastic, @SBousseaden, Huntrule Team
date: 2022-04-27
modified: 2024-08-13
tags:
  - attack.privilege-escalation
  - attack.credential-access
  - attack.t1548
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    LogonType: 3
    AuthenticationPackageName: Kerberos
    IpAddress: 127.0.0.1
    TargetUserSid|startswith: S-1-5-21-
    TargetUserSid|endswith: "-500"
  filter_main_ip_null:
    IpPort: "0"
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 749c9f5e-b353-4b90-a9c1-05243357ca4b
    type: derived