Weakly-Encrypted Kerberos TGT Response

Analytics BIOC Informational

Weakly-Encrypted Kerberos TGT Response

A weakly encrypted Kerberos TGT was issued by a domain controller. The encryption type is abnormal for this DC and results in a TGT that is easier to crack. This behavior may indicate a Skeleton Key attack.

Module:: Platform Analytics
Data source:: Palo Alto Networks Firewall EAL Logs, XDR Agent

ATT&CK tactics: Credential Access (TA0006) Defense Evasion (TA0005) Persistence (TA0003)

ATT&CK techniques: Modify Authentication Process: Domain Controller Authentication (T1556.001)

Attacker's goals:

Manipulate the domain controller authentication process to bypass standard authentication and gain access to hosts and resources in environments relying on single-factor authentication.

Investigative actions:

Identify the user or entity that requested the TGT during the alert timeframe. Determine whether a legitimate service or application requested weak Kerberos encryption. Verify whether the domain controller is patched against the Skeleton Key vulnerability (CVE-2016-1567).

Test period:: N/A (single event)
Deduplication:: 1 Day

1 variation:

Abnormal Weakly-Encrypted Kerberos TGT Response Low (parent: Informational)