Windows Security 4738 Kerberoast Risk via Weak Encryption Enabled UAC Change

title: Windows Security 4738 Kerberoast Risk via Weak Encryption Enabled UAC Change
id: d27fecb6-80d0-4d44-a8cb-e23f178e4198
status: test
description: This rule identifies Active Directory user account changes (Event ID 4738) where a user profile’s userAccountControl settings transition to enable weaker encryption or weaker pre-auth behavior. Such changes can make password/hash material more susceptible to offline cracking, which attackers may leverage during Kerberoasting. The detection relies on Security audit telemetry for account modification events and matching the before/after UAC bit patterns for the encryption-related flags.
references:
  - https://adsecurity.org/?p=2053
  - https://blog.harmj0y.net/redteaming/another-word-on-delegation/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_alert_enable_weak_encryption.yml
author: "@neu5ron, Huntrule Team"
date: 2017-07-30
modified: 2021-11-27
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  service: security
  definition: "Requirements: Audit Policy : Account Management > Audit User Account Management, Group Policy : Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Account Management\\Audit User Account Management"
detection:
  selection:
    EventID: 4738
  olduac_des:
    OldUacValue|endswith:
      - 8???
      - 9???
      - A???
      - B???
      - C???
      - D???
      - E???
      - F???
  newuac_des:
    NewUacValue|endswith:
      - 8???
      - 9???
      - A???
      - B???
      - C???
      - D???
      - E???
      - F???
  olduac_preauth:
    OldUacValue|endswith:
      - 1????
      - 3????
      - 5????
      - 7????
      - 9????
      - B????
      - D????
      - F????
  newuac_preauth:
    NewUacValue|endswith:
      - 1????
      - 3????
      - 5????
      - 7????
      - 9????
      - B????
      - D????
      - F????
  olduac_encrypted:
    OldUacValue|endswith:
      - 8??
      - 9??
      - A??
      - B??
      - C??
      - D??
      - E??
      - F??
  newuac_encrypted:
    NewUacValue|endswith:
      - 8??
      - 9??
      - A??
      - B??
      - C??
      - D??
      - E??
      - F??
  condition: selection and ((newuac_des and not olduac_des) or (newuac_preauth and not olduac_preauth) or (newuac_encrypted and not olduac_encrypted))
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f6de9536-0441-4b3f-a646-f4e00f300ffd
    type: derived