
title: Suspicious Outbound Kerberos Connection
author: Ilyas Ochkov, oscd.community
date: 2019/10/24
description: Detects suspicious outbound network activity via kerberos default port
  indicating possible lateral movement or first stage PrivEsc via delegation.
detection:
  SELECTION_1:
    EventID: 5156
  SELECTION_2:
    DestinationPort: 88
  SELECTION_3:
    Image:
    - '*\lsass.exe'
    - '*\opera.exe'
    - '*\chrome.exe'
    - '*\firefox.exe'
  condition: ((SELECTION_1 and SELECTION_2) and  not (SELECTION_3))
falsepositives:
- Other browsers
id: eca91c7c-9214-47b9-b4c5-cb1d7e4f2350
level: high
logsource:
  product: windows
  service: security
modified: 2019/11/13
references:
- https://github.com/GhostPack/Rubeus
status: experimental
tags:
- attack.lateral_movement
- attack.t1208
- attack.t1558.003
ruletype: SIGMA
