From e418282fabcb99927ce337fb53ac4a561770655f Mon Sep 17 00:00:00 2001 From: munzzyy Date: Sun, 5 Jul 2026 16:41:15 -0500 Subject: [PATCH 1/2] Fix TargetUserName computer account filter in computer service ticket detection TargetUserName can come through as a userPrincipalName (sAMAccountName@domain.tld) instead of a plain sAMAccountName, in which case the existing TargetUserName!="*$" filter never matches and computer accounts leak into the results. Normalize TargetUserName to the part before the @ first, same approach already used in suspicious_kerberos_service_ticket_request.yml, then filter on that. Fixes #4083 --- ...large_number_of_computer_service_tickets_requested.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml b/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml index bbed89c02d..a85a6337d3 100644 --- a/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml +++ b/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml @@ -1,8 +1,8 @@ name: Windows Large Number of Computer Service Tickets Requested id: 386ad394-c9a7-4b4f-b66f-586252de20f0 -version: 11 +version: 12 creation_date: '2023-03-21' -modification_date: '2026-05-13' +modification_date: '2026-07-05' author: Mauricio Velazco, Splunk status: production type: Anomaly @@ -10,7 +10,9 @@ description: The following analytic detects a high volume of Kerberos service ti data_source: - Windows Event Log Security 4769 search: |- - `wineventlog_security` EventCode=4769 ServiceName="*$" TargetUserName!="*$" + `wineventlog_security` EventCode=4769 ServiceName="*$" + | eval TargetUserName = mvindex(split(TargetUserName, "@"), 0) + | search NOT TargetUserName="*$" | bucket span=5m _time | stats dc(ServiceName) AS unique_targets values(ServiceName) as host_targets values(dest) as dest BY _time, IpAddress, TargetUserName From cf57f42ab430f43d020d0904ce210bd9338935b6 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Wed, 22 Jul 2026 11:04:08 +0200 Subject: [PATCH 2/2] Update windows_large_number_of_computer_service_tickets_requested.yml --- ..._of_computer_service_tickets_requested.yml | 23 +++++++++++-------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml b/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml index a85a6337d3..a8fed6397c 100644 --- a/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml +++ b/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml @@ -6,18 +6,23 @@ modification_date: '2026-07-05' author: Mauricio Velazco, Splunk status: production type: Anomaly -description: The following analytic detects a high volume of Kerberos service ticket requests, specifically more than 30, from a single source within a 5-minute window. It leverages Event ID 4769, which logs when a Kerberos service ticket is requested, focusing on requests with computer names as the Service Name. This behavior is significant as it may indicate malicious activities such as lateral movement, malware staging, or reconnaissance. If confirmed malicious, an attacker could gain unauthorized access to multiple endpoints, potentially compromising the entire network. +description: |- + The following analytic detects a high volume of Kerberos service ticket requests, specifically more than 30, from a single source within a 5-minute window. + It leverages Event ID 4769, which logs when a Kerberos service ticket is requested, focusing on requests with computer names as the Service Name. This behavior is significant as it may indicate malicious activities such as lateral movement, malware staging, or reconnaissance. + If confirmed malicious, an attacker could gain unauthorized access to multiple endpoints, potentially compromising the entire network. data_source: - Windows Event Log Security 4769 search: |- - `wineventlog_security` EventCode=4769 ServiceName="*$" - | eval TargetUserName = mvindex(split(TargetUserName, "@"), 0) - | search NOT TargetUserName="*$" - | bucket span=5m _time - | stats dc(ServiceName) AS unique_targets values(ServiceName) as host_targets values(dest) as dest - BY _time, IpAddress, TargetUserName - | where unique_targets > 30 - | `windows_large_number_of_computer_service_tickets_requested_filter` + `wineventlog_security` EventCode=4769 ServiceName="*$" TargetUserName!="*$" + | eval TargetUserName = mvindex(split(TargetUserName, "@"), 0) + | search NOT TargetUserName="*$" + | bucket span=5m _time + | stats dc(ServiceName) AS unique_targets + values(ServiceName) as host_targets + values(dest) as dest + by _time, IpAddress, TargetUserName + | where unique_targets > 30 + | `windows_large_number_of_computer_service_tickets_requested_filter` how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. known_false_positives: An single endpoint requesting a large number of kerberos service tickets is not common behavior. Possible false positive scenarios include but are not limited to vulnerability scanners, administration systems and missconfigured systems. references: