🐾 - 🚨 TGS Granted by 🪟 Service after Suspicious Kerberos TGS-Request 🥷 - T1558 - Suricata Rule 3321415 (pawpatrules)

🐾 - 🚨 TGS Granted by 🪟 Service after Suspicious Kerberos TGS-Request 🥷 - T1558

SID: 3321415Rev: 429 viewsHistory

Sourcepawpatrules

CreatedFebruary 21, 2025

UpdatedMarch 29, 2025

Classificationcredential-theft

alert tcp $HOME_NET 88 -> any any (msg:"🐾 - 🚨 TGS Granted by 🪟 Service after Suspicious Kerberos TGS-Request 🥷 - T1558"; flow:to_client, stateless; flowbits:isset,pptrls.suspkrbtgsrep; content:"|30 82|"; content:"|03 02 01 05|"; distance:3; content:"|03 02 01 0d|"; distance:1; target:src_ip; metadata:created_at 2025_02_21, updated_at 2025_03_29, signature_severity Major, attack_target Server_Endpoint, affected_product Windows_Server_32_64_Bit, mitre_tactic_id TA0006, mitre_tactic_name Credential_Access, mitre_technique_id T1558, mitre_technique_name Steal_or_Forge_Kerberos_Tickets; sid:3321415; rev:4; classtype:credential-theft;)

Metadata

created at2025_02_21

updated at2025_03_29

signature severityMajor

attack targetServer_Endpoint

affected productWindows_Server_32_64_Bit

mitre tactic idTA0006

mitre tactic nameCredential_Access

mitre technique idT1558

mitre technique nameSteal_or_Forge_Kerberos_Tickets

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!