
title: Kerberos Manipulation
author: Florian Roth
date: 2017/02/10
description: This method triggers on rare Kerberos Failure Codes caused by manipulations
  of Kerberos messages
detection:
  SELECTION_1:
    EventID: 675
  SELECTION_2:
    EventID: 4768
  SELECTION_3:
    EventID: 4769
  SELECTION_4:
    EventID: 4771
  SELECTION_5:
    FailureCode:
    - '0x9'
    - '0xA'
    - '0xB'
    - '0xF'
    - '0x10'
    - '0x11'
    - '0x13'
    - '0x14'
    - '0x1A'
    - '0x1F'
    - '0x21'
    - '0x22'
    - '0x23'
    - '0x24'
    - '0x26'
    - '0x27'
    - '0x28'
    - '0x29'
    - '0x2C'
    - '0x2D'
    - '0x2E'
    - '0x2F'
    - '0x31'
    - '0x32'
    - '0x3E'
    - '0x3F'
    - '0x40'
    - '0x41'
    - '0x43'
    - '0x44'
  condition: ((SELECTION_1 or SELECTION_2 or SELECTION_3 or SELECTION_4) and SELECTION_5)
falsepositives:
- Faulty legacy applications
id: f7644214-0eb0-4ace-9455-331ec4c09253
level: high
logsource:
  product: windows
  service: security
status: experimental
tags:
- attack.credential_access
- attack.t1212
ruletype: SIGMA
