Windows Security: Failed Kerberos TGT Request (Event 675/4768/4769/4771)

title: "Windows Security: Failed Kerberos TGT Request (Event 675/4768/4769/4771)"
id: 362224ac-e75c-4d9e-8cd9-e15ceb4b2fd6
status: test
description: This rule flags Windows Security events indicating failed Kerberos TGT-related operations, based on specific Event IDs and failure status codes. Attackers may trigger these failures when manipulating or attempting to obtain Kerberos tickets in a way that does not succeed. The detection relies on telemetry from the Windows Security log capturing the relevant Kerberos event IDs and their associated status values.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4771
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_kerberos_manipulation.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-02-10
modified: 2024-01-16
tags:
  - attack.credential-access
  - attack.t1212
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 675
      - 4768
      - 4769
      - 4771
    Status:
      - "0x9"
      - "0xA"
      - "0xB"
      - "0xF"
      - "0x10"
      - "0x11"
      - "0x13"
      - "0x14"
      - "0x1A"
      - "0x1F"
      - "0x21"
      - "0x22"
      - "0x23"
      - "0x24"
      - "0x26"
      - "0x27"
      - "0x28"
      - "0x29"
      - "0x2C"
      - "0x2D"
      - "0x2E"
      - "0x2F"
      - "0x31"
      - "0x32"
      - "0x3E"
      - "0x3F"
      - "0x40"
      - "0x41"
      - "0x43"
      - "0x44"
  condition: selection
falsepositives:
  - Faulty legacy applications
level: high
license: DRL-1.1
related:
  - id: f7644214-0eb0-4ace-9455-331ec4c09253
    type: derived