Techniques › T1550.003 › AN1000
AN1000 Analytic 1000
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects unauthorized Kerberos ticket injection by correlating service ticket (TGS - 4769) requests with absent corresponding account logons (4624) and prior Ticket Granting Ticket (TGT - 4768) activity. Highlights anomalous service ticket generation chains involving unexpected users, hosts, or times, and suspicious injection of tickets via mimikatz-like tooling into LSASS memory. Behavior also includes network lateral movement using Kerberos authentication absent expected interactive logon patterns.</p>
- Detects
- T1550.003 Pass the Ticket
- Part of
- DET0352 Detection Strategy for T1550.003 - Pass the Ticket (Windows)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4769 | DC0002 User Account Authentication |
| WinEventLog:Security | EventCode=4768 | DC0084 Active Directory Credential Request |
| WinEventLog:Security | EventCode=4624, 4648 | DC0067 Logon Session Creation |
| WinEventLog:Sysmon | EventCode=10 | DC0035 Process Access |
| WinEventLog:Sysmon | EventCode=7 | DC0016 Module Load |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Defines the correlation window between TGT request (4768) and TGS request (4769) |
HostContextScope | Adjusts the host scoping for correlation of authentication chains and ticket injection |
LSASSAccessAnomalyThreshold | Allows tuning of alerts for ticket injection attempts via LSASS memory access |