A security analyst reviewing a Security Information and Event Management (SIEM) log aggreg… — CompTIA Security+

A security analyst reviewing a Security Information and Event Management (SIEM) log aggregator observes the following consecutive Kerberos event entries generated by internal endpoint `10.0.12.88` within a 90-second time window:

Based on the log output, which attack technique is taking place, and what correlation rule condition should the analyst configure in the SIEM to detect this activity?

Kerberoasting; configure a correlation rule that triggers when a single source IP generates multiple Event ID 4769 Ticket Granting Service (TGS) requests requesting RC4 encryption (0x17) for Service Principal Names (SPNs) within a short time threshold.Answer
B
Password spraying; configure a correlation rule that triggers on a high frequency of Event ID 4768 Authentication Ticket requests returning error code 0x18 across multiple user accounts.
C
Golden Ticket attack; configure a correlation rule that triggers when Kerberos tickets are granted without prior user authentication in the active directory logs.
D
Pass-the-Hash attack; configure a preventive SIEM automated response rule to block NTLM authentication traffic across internal network segments.

Answer

Kerberoasting; configure a correlation rule that triggers when a single source IP generates multiple Event ID 4769 Ticket Granting Service (TGS) requests requesting RC4 encryption (0x17) for Service Principal Names (SPNs) within a short time threshold.

The provided log snippet shows multiple Windows Security Event ID 4769 (Kerberos Service Ticket Request) events returning status code 0x0 (Success) within a 90-second window. All requests target service accounts (`svc_*`) with SPNs and explicitly request encryption type `0x17` (RC4-HMAC). This pattern is characteristic of Kerberoasting, an attack where an adversary requests Kerberos service tickets for accounts with SPNs to extract the ticket hashes from memory and attempt offline password cracking. Effective SIEM detection requires creating a correlation rule that flags a single IP or user requesting multiple 4769 events with RC4 (0x17) encryption over a short time threshold.

Step-by-Step Solution

Analyze the event codes and fields in the log entries.

Identified Event ID 4769 (A Kerberos service ticket was requested) with successful status 0x0, target users designated as service accounts (`svc_*`), and ticket encryption type 0x17.

Event ID 4769 logs specifically track TGS ticket requests submitted to Domain Controllers for accessing resources bound to Service Principal Names (SPNs).

Evaluate the encryption type indicator (`0x17`).

Recognized `0x17` as the cipher identifier for legacy RC4-HMAC encryption in Windows Kerberos implementations.

Attacking tools (such as Rubeus or GetUserSPNs.py) explicitly request RC4 encryption because RC4-HMAC password hashes are significantly faster to crack offline using brute-force tools compared to AES-128/256.

Correlate the observed pattern to determine the attack vector and detection strategy.

Rapid sequential TGS requests for multiple service accounts requesting legacy RC4 encryption from a single host indicates a Kerberoasting reconnaissance/extraction phase. A SIEM correlation rule looking for multiple Event ID 4769 events with encryption type 0x17 within a short time frame directly identifies this threat.

Normal enterprise traffic utilizes modern AES encryption for Kerberos tickets unless legacy constraints exist; rapid bursts of RC4-encrypted TGS requests across diverse SPNs are a signature indicator of Kerberoasting.

Key Concept

Kerberoasting Log Analysis and SIEM Correlation Rule Logic

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic