Uncommon Outbound Kerberos Connection
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "sa_network_connection" AND (DEST_PORT = 88 AND IS_INITIATED = "true") AND PROCESSNAME != "C:\Windows\System32\lsass.exe" AND (PROCESSNAME != "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe,C:\Program Files\Google\Chrome\Application\chrome.exe" AND PROCESSNAME != "C:\Program Files (x86)\Mozilla Firefox\firefox.exe,C:\Program Files\Mozilla Firefox\firefox.exe" AND PROCESSNAME notendswith "\tomcat\bin\tomcat8.exe") select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.PROCESSNAME,Action1.DESTINATIONHOST,Action1.DESTINATION_IPV6,Action1.DEST_IP,Action1.SOURCEHOST,Action1.SOURCE_IP,Action1.SOURCE_IPV6
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Ilyas Ochkov, oscd.community
