Examkin

Question

Difficulty: MediumLog Analysis and SIEM Management

A Security Operations Center (SOC) analyst is reviewing alerts generated by a SIEM correlation rule designed to flag potential credential harvesting activity. Within a five-minute window, a standard domain user workstation generated multiple instances of the following Windows Security Event log entry:

Event ID: 4769
Task Category: Kerberos Service Ticket Operations
TargetUserName: [email protected]
Service Name: MSSQLSvc/db01.contoso.com:1433
Ticket Options: 0x40810000
Ticket Encryption Type: 0x17
Failure Code: 0x0
Client Address: ::ffff:192.168.10.115

Based on this log telemetry, which of the following security events is occurring?

  1. A Kerberoasting attack requesting a service ticket with weak RC4 encryption to crack the service account password offline.Answer
  2. B
    A brute-force authentication attack attempting password combinations directly against the SQL database service port.
  3. C
    An authorization bypass attack where a low-privileged account attempts to gain unauthorized database access privileges.
  4. D
    A SQL injection attack transmitting malicious database queries over an unvalidated web application input field.

Answer

A Kerberoasting attack requesting a service ticket with weak RC4 encryption to crack the service account password offline.
The correct answer identifies a Kerberoasting attack. Windows Event ID 4769 logs when a Kerberos service ticket (TGS) is requested. A key indicator of Kerberoasting is a standard user requesting TGS tickets for accounts with registered Service Principal Names (SPNs) specifying weak encryption types such as RC4 (0x17). The attacker can extract the encrypted ticket payload from memory or network traffic and attempt to crack the service account's password offline.

Step-by-Step Solution

1
Analyze the Event ID and Service Name in the log snippet.
Event ID 4769 records Kerberos service ticket requests (TGS-REQ/TGS-REP) processed by Active Directory Domain Controllers.
Identifying the event type establishes that the activity relates to Kerberos ticket granting rather than application-layer network traffic.
2
Examine the Ticket Encryption Type field value (0x17).
Value 0x17 corresponds to legacy RC4-HMAC encryption.
Attackers specifically request service tickets with weak RC4 encryption because RC4 hashes are significantly easier to crack offline using password dictionary attacks compared to AES encryption (0x12).
3
Synthesize the event telemetry context.
Repeated requests from a standard user workstation for Service Principal Name (SPN) tickets using RC4 encryption indicates Kerberoasting.
Kerberoasting allows non-admin domain users to request TGS tickets for any account with a configured SPN and extract the password hash for offline brute-forcing.

Key Concept

Kerberoasting Detection via SIEM Log Analysis
Estimated Time:1m 30s
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic