Skip to content
Threat Feed
Subscribe
high advisory

PetitPotam Suspicious Kerberos TGT Request

This analytic detects suspicious Kerberos TGT requests following the potential abuse of Active Directory Certificate Services (ADCS) in combination with PetitPotam.

Triage facts

Revision 1
Applicability
windows
Evidence
Unknown
Severity
High
Sources
4 public sources
Freshness
Revision 1Nov 13, 05:40 UTC
Detection
1 rule
Source quality
A2Roughly even chance

PetitPotam can be used to force a computer to authenticate against a remote server. In combination with Active Directory Certificate Services (ADCS), this technique may allow an attacker to obtain a computer certificate. This certificate can then be leveraged to request a Kerberos Ticket Granting Ticket (TGT).

Attack Chain

  1. Attacker abuses ADCS in combination with PetitPotam to obtain a computer certificate.
  2. Attacker leverages the certificate to request a Kerberos TGT.
  3. The request generates a 4768 event with potentially unusual fields.

Recommendation

  • Deploy the Sigma rule below to monitor for anomalous 4768 events.
  • Tune the detection by filtering the Account_Name to Domain Controller computer accounts.
  • Ensure the advanced audit policy setting "Account Logon > Kerberos Authentication Service" is configured for Success/Failure.

Detection coverage 1

PetitPotam Suspicious Kerberos TGT Request

high

Detects suspicious Kerberos TGT requests that may follow PetitPotam and ADCS abuse. Requires tuning by filtering the Account_Name to the Domain Controller computer accounts.

sigma tactics: credential-access techniques: T1187 sources: windows, security

Detection queries are available on the platform. Get full rules →