Analytics BIOC Medium
✕

Possible compromised machine account

A Kerberos TGT for machine account has been used and does not match the hostname.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Execution (TA0002)
ATT&CK techniques: User Execution (T1204)
Attacker's goals:

Gain a special user Kerberos ticket to move laterally.

Investigative actions:

Check the source host for possible credential dumping. Check the delegated account credentials and if it has high privileges. Check the ticket destination to verify whether it is a sensitive asset.

Test period:
N/A (single event)
Deduplication:
1 Day