Examkin

Question

Difficulty: Very hardLog Analysis and SIEM Management

A Security Operations Center (SOC) analyst receives a high-severity SIEM alert and extracts the following raw Active Directory Kerberos ticket request log entry from a central domain controller:

text
Event ID: 4769
Status: 0x0
TargetUserName: [email protected]
Service Name: MSSQLSvc/sql-prod01.finance.local:1433
Service ID: S-1-5-21-3829102-1204918-948102-5102
Ticket Options: 0x40810000
Ticket Encryption Type: 0x17
Client Address: ::ffff:10.12.84.45
Client Port: 53218

Based on the log snippet provided, which threat activity is occurring, and how should the SIEM correlation rule be configured to detect future instances of this attack while minimizing false positives?

  1. A
    A Pass-the-Hash attack is occurring; configure the SIEM correlation rule to monitor NTLM authentication failures (Event ID 4625) originating from non-domain endpoints.
  2. A Kerberoasting attack is occurring; configure the SIEM correlation rule to flag Event ID 4769 requests that specify legacy RC4 encryption (0x17) for non-machine Service Principal Names (SPNs).Answer
  3. C
    An unauthorized authorization policy bypass is occurring; modify the SIEM rule to trigger a detective alert whenever user accounts fail access control evaluations against database schemas.
  4. D
    A Golden Ticket attack is occurring; deploy a preventive network firewall control rule to automatically drop all inbound connections originating from host IP 10.12.84.45.

Answer

The activity represents a Kerberoasting attack. The SIEM correlation rule should be configured to detect Event ID 4769 logs requesting RC4 encryption (0x17) associated with non-machine user accounts.
The log entry displays Windows Event ID 4769 (Kerberos Service Ticket Request) with a Ticket Encryption Type of 0x17 (RC4-HMAC) for a database service principal name (MSSQLSvc). In Kerberoasting attacks, adversary accounts request Kerberos service tickets for accounts with configured SPNs explicitly requesting downgrade to RC4 encryption, which allows for fast offline cracking of the service account's plain-text password. Fine-tuning the SIEM correlation rule to watch for Event ID 4769 where Ticket Encryption Type is 0x17 targeting user-associated SPNs provides high-confidence detection.

Step-by-Step Solution

1
Analyze Event ID and Log Metadata
Event ID 4769 corresponds to a Kerberos Service Ticket Request (TGS-REQ). Status 0x0 confirms the request succeeded.
Identifying the event type establishes whether authentication, authorization, or service ticket issuing is taking place.
2
Evaluate Service Name and Encryption Type Parameters
The Service Name targets a SQL service SPN (`MSSQLSvc/...`), and the requested Ticket Encryption Type is `0x17` (RC4-HMAC).
Modern Active Directory environments default to AES-128 (0x12) or AES-256 (0x18). Requesting RC4 (0x17) allows threat actors to extract the ticket from memory and perform offline password brute-forcing (Kerberoasting).
3
Determine Optimal SIEM Correlation Logic
A high-fidelity rule filters for Event ID 4769 where `Ticket Encryption Type` equals `0x17` and the `TargetUserName` is a service account.
Filtering specifically on legacy encryption requests for user-bound SPNs isolates offline ticket extraction attacks while excluding standard AES kerberos traffic.

Key Concept

Kerberoasting Detection via Event ID 4769 Analysis
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic