Detecting the Elusive

Active Directory Threat Hunting

Sean Metcalf (@Pyrotek3)

s e a n [@] TrimarcSecurity.com
www.ADSecurity.org
TrimarcSecurity.com
 ABOUT
• Founder Trimarc, a security company.
• Microsoft Certified Master (MCM) Directory Services
• Microsoft MVP
• Speaker: BSides, Shakacon, Black Hat, DEF CON, DerbyCon,
& Sp4rkCon
• Security Consultant / Security Researcher
• Own & Operate ADSecurity.org
(Microsoft platform security info)
Sean Metcalf [@Pyrotek3 | [email protected]]
AGENDA
• The Setup
• Tracking Command-line/PowerShell Activity
• PS without PowerShell.exe & 06fu$c@t10n
• Auditing Attacker Activity
• Kerberoasting Detection

Sean Metcalf [@Pyrotek3 | [email protected]]

Sean Metcalf [@Pyrotek3 | [email protected]]
Sean Metcalf [@Pyrotek3 | [email protected]]
Sean Metcalf [@Pyrotek3 | [email protected]]
Sean Metcalf [@Pyrotek3 | [email protected]]
Are We…
• Logging the correct type of data?
• Logging the correct Event IDs?
• Logging what’s needed on all types of systems?
• Forwarding log data to our central system (SIEM/Splunk)?
• Actually seeing these events in the central system?
• Correlating Event IDs to anomalous activity?

Sean Metcalf [@Pyrotek3 | [email protected]]

What is Normal?

Sean Metcalf [@Pyrotek3 | [email protected]]

What is Normal
Anomalous?
Sean Metcalf [@Pyrotek3 | [email protected]]
Monitor Enterprise Command Line Activity
Enable CMD Process logging & enhancement:
 Windows 2003: Event ID 592
 Windows 2008/Vista: Event ID 4688
 Windows 7/2008R2 & KB3004375: Log process & child
process
Enable PowerShell module logging.
Forward events to SIEM tool (use WEF as needed).
Research the use of Sysmon for enhanced logging

Sean Metcalf [@Pyrotek3 | [email protected]]

Microsoft Sysinternals System Monitor (Sysmon)
• Windows service with device driver (32 & 64 bit versions)
• Config data stored in HKLM\System\CCS\Services\SysmonDrv\Parameters
• Monitor:
• Process activity with hashes (check hashes with VirusTotal)
• Image loads (DLLs)
• Driver loads (system drivers)
• File creation time changes (may be attack activity, may be zip extraction)
• Network connections (look for suspicious program activity)
• RawAccess read (Invoke-Ninjacopy.ps1)
• Sysmon service change
• Identify common attack activity
• Monitor network activity for specific applications (notepad.exe)
• Winlogon & LSASS injection
• Ignore Microsoft signed image loads*
Sean Metcalf [@Pyrotek3 | [email protected]]
Interesting Microsoft Binaries to Monitor
• ClickOnce Applications
• dfsvc.exe (dfshim.dll)
• InstallUtil.exe
• Msbuild.exe
• Regsvr32.exe
• Rundll32.exe
• Bitsadmin.exe
https://github.com/subTee/ApplicationWhitelistBypassTechniques/blob/master/TheList.txt
Sean Metcalf [@Pyrotek3 | [email protected]]
Sean Metcalf [@Pyrotek3 | [email protected]]
Sean Metcalf [@Pyrotek3 | [email protected]]
Windows Event Forwarding: WEF FTW!
• Configure WEF server by enabling WinRM (winrm qc) & Event Collector
service
• Configured clients via GPO
• Computer>Policies>Admin Templates>Windows Components>Event
Forwarding>Configure target subscription manager
• Computer>Policies>Admin Templates>Windows Components>Event Log
Service>Security> Configure log access
• Pros
• No agent/certificates required (WinRM with Kerberos)
• Configure WEF via Group Policy
• Forward specific events to central logging server(s) then on to SIEM
• GUI to configure events for WEF to push to collector (XML behind the scenes)
• Cons
• Initial learning curve
• Not fault tolerant (no, DNS RR doesn’t work)
https://aka.ms/wef
Sean Metcalf [@Pyrotek3 | [email protected]]
PowerShell Logging

Sean Metcalf [@Pyrotek3 | [email protected]]

“PowerWare” MS Office Macro -> PowerShell

https://www.carbonblack.com/2016/03/25/threat-alert-powerware-new-ransomware-written-in-powershell-targets-organizations-via-microsoft-word/
Sean Metcalf [@Pyrotek3 | [email protected]]
 Microsoft Office Macros (VBA)

• Many organizations are

compromised by a single
Word/Excel document.
• Office Macro = Code

https://www.fireeye.com/blog/threat-research/2015/10/macros_galore.html
Sean Metcalf [@Pyrotek3 | [email protected]]
@JohnLaTwC
https://onedrive.live.com/?authkey=%21ADev0bfQMNxv504&cid=C96A3EEDCE316E4C&id=C96A3EEDCE316E4C%21114&par
Sean Metcalf [@Pyrotek3 | [email protected]]
Id=C96A3EEDCE316E4C%21109&o=OneUp
 Microsoft OLE
• OLE Package (packager.dll)
Windows 3.1 to Windows 10.

• Office 2003 to 2016 support.

• Disable in Outlook via regkey

(ShowOLEPackageOBJ to “0”).

https://medium.com/@networksecurity/oleoutlook-bypass-almost-every-corporate-security-control-with-a-point-n-click-gui-37f4cbc107d0

Sean Metcalf [@Pyrotek3 | [email protected]]

 PowerShell Module Logging
• PowerShell version 3 and up.
• Enable via Group Policy:
• Computer Configuration\Policies\Administrative
Template\Windows Components\Windows PowerShell.
• Logging enhanced in PowerShell v4.
• PowerShell v5 has compelling logging features.

Sean Metcalf [@Pyrotek3 | [email protected]]

PowerShell v5 Security Enhancements
• Script block logging – Enable today
• System-wide transcripts – Test & Configure
• Constrained PowerShell enforced when application
whitelisting enabled (AppLocker/Device Guard)
• Antimalware Integration (AMSI in Win 10)
http://blogs.msdn.com/b/powershell/archive/2015/06/09/powershell-the-blue-team.aspx

Windows Management Framework (WMF) version 5 available for download:

https://www.microsoft.com/en-us/download/details.aspx?id=50395
Sean Metcalf [@Pyrotek3 | [email protected]]
 Security Vendors Supporting Win10 AMSI
4. Avast: ??
5. Trend Micro: ??
1. Microsoft Defender 6. Symantec: ???
2. AVG Protection 7. McAfee: ???
2016.7496 8. Sophos: ??
3. ESET Version 10 9. Kaspersky: ??
10. BitDefender: ??
11. F-Secure : ??
Last Updated: March 2017
12. Avira : ??
Sean Metcalf [@Pyrotek3 | [email protected]] 13. Panda : ??
PowerShell without PowerShell.exe
Sean Metcalf [@Pyrotek3 | [email protected]]
 Run PowerShell from .Net
• PowerShell =
System.Management.Automation.dll
• Applications can run PowerShell code
• “PowerShell ps = PowerShell.Create()”
• Ben Ten’s “Not PowerShell”
https://github.com/Ben0xA/nps

Sean Metcalf [@Pyrotek3 | [email protected]]

Sean Metcalf [@Pyrotek3 | [email protected]]
Sean Metcalf [@Pyrotek3 | [email protected]]
PS Constrained Language Mode?

Sean Metcalf [@Pyrotek3 | [email protected]]

PowerShell v5 Security Log Data?

Sean Metcalf [@Pyrotek3 | [email protected]]

Sean Metcalf [@Pyrotek3 | [email protected]]
Detecting/Mitigating PS w/o PowerShell.exe
• Discover PowerShell in non-standard processes.
• Get-Process modules like “*Management.Automation*”

Sean Metcalf [@Pyrotek3 | [email protected]]

Sean Metcalf [@Pyrotek3 | [email protected]]
Detecting/Mitigating PS w/o PowerShell.exe

Sean Metcalf [@Pyrotek3 | [email protected]]

 Detecting Custom EXEs Hosting PowerShell
• Send PowerShell & PowerShell Operational logs to SIEM.
• Event 400/800: HostApplication not standard Microsoft tool
(PowerShell, PowerShell ISE, etc).
• Event 400/800: EngineVersion < PowerShell version.
• System.Management.Automation.(ni.)dll hosted in non-
standard processes.
• Remember that custom EXEs can natively call .Net & Windows
APIs directly without PowerShell.
• Remove PowerShell 2.0 engine from Windows 8/2012+ (still
requires Microsoft .NET Framework 3.5 for use).
Sean Metcalf [@Pyrotek3 | [email protected]]
Sean Metcalf [@Pyrotek3 | [email protected]]
Sean Metcalf [@Pyrotek3 | [email protected]]
Sean Metcalf [@Pyrotek3 | [email protected]]
Obfuscation Bypasses AV

Sean Metcalf [@Pyrotek3 | [email protected]]

Sean Metcalf [@Pyrotek3 | [email protected]]
Sean Metcalf [@Pyrotek3 | [email protected]]
 Finding Obfuscated Evil
Regular Obfuscated
e $
t {
r }
a +
i “
o =
n [
s (
l ;

Sean Metcalf [@Pyrotek3 | [email protected]]

http://www.leeholmes.com/blog/2016/10/22/more-detecting-obfuscated-powershell/
Finding Obfuscated Evil
• Deploy PowerShell v5.
• Enable PowerShell script block logging.
• Look at length of PowerShell command
• Look for lots of brackets { }

• Look for lots of quotes (single & double) “ “ & ‘ ’

• Look for random function names & many unusual characters not
normally in PowerShell scripts.
Sean Metcalf [@Pyrotek3 | [email protected]]
Offensive PowerShell Detection Cheatsheet
• AdjustTokenPrivileges • TOKEN_ADJUST_PRIVILEGES
• IMAGE_NT_OPTIONAL_HDR64_MAGIC • TOKEN_ALL_ACCESS
• Management.Automation.RuntimeException • TOKEN_ASSIGN_PRIMARY
• Microsoft.Win32.UnsafeNativeMethods • TOKEN_DUPLICATE
• ReadProcessMemory.Invoke • TOKEN_ELEVATION
• Runtime.InteropServices • TOKEN_IMPERSONATE
• SE_PRIVILEGE_ENABLED • TOKEN_INFORMATION_CLASS
• System.Security.Cryptography • TOKEN_PRIVILEGES
• System.Reflection.AssemblyName • TOKEN_QUERY
• System.Runtime.InteropServices • Metasploit
• LSA_UNICODE_STRING • Advapi32.dll
• kernel32.dll
• MiniDumpWriteDump
• AmsiUtils
• PAGE_EXECUTE_READ
• KerberosRequestorSecurityToken
• Net.Sockets.SocketFlags
• Security.Cryptography.CryptoStream
• Reflection.Assembly
• ScriptBlockLogging
• SECURITY_DELEGATION
• LogPipelineExecutionDetails
• CreateDelegate
Sean Metcalf [@Pyrotek3 | [email protected]] • ProtectedEventLogging
Auditing Attack Activity

Sean Metcalf [@Pyrotek3 | [email protected]]

Active Directory (DC) Logging
• Originally 9 audit settings.
• WinVista/2008+: Advanced Audit Policy Settings
• 53 new settings provides more granular auditing.
• Win7/2008R2+: Special Logon auditing (Event ID 4694)
• Track logons to the system by members of specific groups.
• HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Ls
a\Audit registry

Sean Metcalf [@Pyrotek3 | [email protected]]

Sean Metcalf [@Pyrotek3 | [email protected]]
Sean Metcalf [@Pyrotek3 | [email protected]]
auditpol.exe /get /category:*

Sean Metcalf [@Pyrotek3 | [email protected]]

 Recommended DC Auditing
• Account Logon • DS Access
• Audit Credential Validation: S&F • Audit Directory Service Access: S&F
• Audit Kerberos Authentication Service: S&F • Audit Directory Service Changes: S&F
• Audit Kerberos Service Ticket Operations: • Logon and Logoff
Success & Failure
• Audit Account Lockout: Success
• Account Management • Audit Logoff: Success
• Audit Computer Account Management: S&F • Audit Logon: S&F
• Audit Other Account Management Events: • Audit Special Logon: Success & Failure
S&F
• Audit Security Group Management: S&F • System
• Audit User Account Management: S&F • Audit IPsec Driver : S&F
• Audit Security State Change : S&F
• Detailed Tracking • Audit Security System Extension : S&F
• Audit DPAPI Activity: S&F Audit System Integrity : S&F
• Audit Process Creation: S&F
Sean Metcalf [@Pyrotek3 | [email protected]]
 Special Logon Auditing (Event ID 4964)
• Track logons to the system by members of specific groups (Win
7/2008 R2+)
• Events are logged on the system to which the user authenticates.
• HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Audit (Event ID
4908: updated table)
• Local Accounts: S-1-5-113
• Domain Admins: S-1-5-21-[DOMAIN]-512
• Enterprise Admins: S-1-5-21-[FORESTROOTDOMAIN]-519
• Custom Group: Create a new group
• Administrators : S-1-5-32-544 (Could be noisy)
https://blogs.technet.microsoft.com/jepayne/2015/11/26/tracking-lateral-movement-part-one-special-groups-and-
specific-service-accounts/ Sean Metcalf [@Pyrotek3 | [email protected]]
Sean Metcalf [@Pyrotek3 | [email protected]]
Sean Metcalf [@Pyrotek3 | [email protected]]
Event IDs that Matter: Domain Controllers
EventID Description Impact
4768 Kerberos auth ticket (TGT) was requested Track user Kerb auth, with client/workstation name.
4769 User requests a Kerberos service ticket Track user resource access requests & Kerberoasting
4964 Custom Special Group logon tracking Track admin & “users of interest” logons
4625/4771 Logon failure Interesting logon failures. 4771 with 0x18 = bad pw
4765/4766 SID History added to an account/attempt If you aren’t actively migrating accounts between
failed domains, this could be malicious
4794 DSRM account password change attempt If this isn’t expected, could be malicious
4780 ACLs set on admin accounts If this isn’t expected, could be malicious
4739/643 Domain Policy was changed If this isn’t expected, could be malicious
4713/617 Kerberos policy was changed If this isn’t expected, could be malicious
4724/628 Attempt to reset an account's password Monitor for admin & sensitive account pw reset
4735/639 Security-enabled local group changed Monitor admin/sensitive group membership changes
4737/641 Security-enabled global group changed Monitor admin/sensitive group membership changes
4755/659 Security-enabled universal group changed Monitor admin & sensitive group membership changes
5136 A directory service object was modified Monitor for GPO changes, admin account modification,
Sean Metcalf [@Pyrotek3 | [email protected]] specific user attribute modification, etc.
Event IDs that Matter: All Windows systems
EventID Description Impact
1102/517 Event log cleared Attackers may clear Windows event logs.
4610/4611/ Local Security Authority modification Attackers may modify LSA for escalation/persistence.
4614/4622
4648 Explicit credential logon Typically when a logged on user provides different credentials to
access a resource. Requires filtering of “normal”.
4661 A handle to an object was requested SAM/DSA Access. Requires filtering of “normal”.
4672 Special privileges assigned to new Monitor when someone with admin rights logs on. Is this an
logon account that should have admin rights or a normal user?
4723 Account password change attempted If it’s not an approved/known pw change, you should know.
4964 Custom Special Group logon tracking Track admin & “users of interest” logons.
7045/4697 New service was installed Attackers often install a new service for persistence.
4698 & 4702 Scheduled task creation/modification Attackers often create/modify scheduled tasks for persistence.
Pull all events in Microsoft-Windows-TaskScheduler/Operational
4719/612 System audit policy was changed Attackers may modify the system’s audit policy.
4732 A member was added to a (security- Attackers may create a new local account & add it to the local
enabled) local group Administrators group.
4720 A (local) user account was created Attackers may create a new local account for persistence.
Sean Metcalf [@Pyrotek3 | [email protected]]
Event IDs that Matter (Newer Windows systems)
EventID Description Impact
3065/3066 LSASS Auditing – checks for code integrity Monitors LSA drivers & plugins. Test
extensively before deploying!
3033/3063 LSA Protection – drivers that failed to load Monitors LSA drivers & plugins & blocks
ones that aren’t properly signed.
4798 A user's local group membership was Potentially recon activity of local group
enumerated. membership. Filter out normal activity.

LSA Protection & Auditing (Windows 8.1/2012R2 and newer):

https://technet.microsoft.com/en-us/library/dn408187(v=ws.11).aspx

4798: A user's local group membership was enumerated (Windows 10/2016):

https://technet.microsoft.com/en-us/itpro/windows/keep-secure/event-4798

Sean Metcalf [@Pyrotek3 | [email protected]]

 A Note About Logon Types (4624)
Logon Name Description Creds Creds in Distribution
Type # on Disk Memory
0 System Typically rare, but could alert to malicious activity Yes Yes *

2 Interactive Console logon (local keyboard) which includes server No Yes #5 / 0%

KVM or virtual client logon. Also standard RunAs.
3 Network Accessing file shares, printers, IIS (integrated auth, No No #1 / ~80%
etc), PowerShell remoting
4 Batch Scheduled tasks Yes Yes #7 / 0%
5 Service Services Yes Yes #4 / <1%
7 Unlock Unlock the system No Yes #6 / <1%
8 Network Clear Text Network logon with password in clear text (IIS basic Maybe Yes #2 / ~15%
auth). If over SSL/TLS, this is probably fine.
9 New Credentials RunAs /NetOnly which starts a program with different No Yes #3 / < 1%
credentials than logged on user
10 Remote RDP: Terminal Services, Remote Assistance, R.Desktop Maybe Yes* #9 / 0%
Interactive
11 Cached Interactive Logon with cached credentials (no DC online) Yes Yes #8 / 0%
Sean Metcalf [@Pyrotek3 | [email protected]]
When the manual is not enough – runas /netonly, Unexpected Credential Exposure and the Need for Reality Based
Holistic Threat Models
https://blogs.technet.microsoft.com/jepayne/2016/04/04/when-the-manual-is-not-enough-runas-netonly-unexpected-
credential-exposure-and-the-need-for-reality-based-holistic-threat-models/ Sean Metcalf [@Pyrotek3 | [email protected]]
 RunAs /NetOnly

When the manual is not enough – runas /netonly, Unexpected Credential Exposure and the Need for Reality Based
Holistic Threat Models
https://blogs.technet.microsoft.com/jepayne/2016/04/04/when-the-manual-is-not-enough-runas-netonly-unexpected-
credential-exposure-and-the-need-for-reality-based-holistic-threat-models/ Sean Metcalf [@Pyrotek3 | [email protected]]
 Mitigation: RunAs /NetOnly

When the manual is not enough – runas /netonly, Unexpected Credential Exposure and the Need for Reality Based
Holistic Threat Models
https://blogs.technet.microsoft.com/jepayne/2016/04/04/when-the-manual-is-not-enough-runas-netonly-unexpected-
credential-exposure-and-the-need-for-reality-based-holistic-threat-models/

Sean Metcalf [@Pyrotek3 | [email protected]]

“Password Spraying”
• Automated password guessing against all users to avoid lockout.
• Attempts logon with password(s) against each user, then moves
on to the next one.

Sean Metcalf [@Pyrotek3 | [email protected]]

“Password Spraying”
• Connect to SMB share or network service
• Let’s start with connections to the PDC’s NETLOGON share…

Sean Metcalf [@Pyrotek3 | [email protected]]

Sean Metcalf [@Pyrotek3 | [email protected]]
Switch from Network Share to AD Connection

Sean Metcalf [@Pyrotek3 | [email protected]]

Sean Metcalf [@Pyrotek3 | [email protected]]
Sean Metcalf [@Pyrotek3 | [email protected]]
Sean Metcalf [@Pyrotek3 | [email protected]]
SPNs, Service Accounts &
Kerberoasting
Sean Metcalf [@Pyrotek3 | [email protected]]
“SPN Scanning” Service Discovery
SQL servers, instances, ports, etc.
MSSQLSvc/adsmsSQL01.adsecurity.org:1433
RDP
TERMSERV/adsmsEXCAS01.adsecurity.org
WSMan/WinRM/PS Remoting
WSMAN/adsmsEXCAS01.adsecurity.org
Forefront Identity Manager
FIMService/adsmsFIM01.adsecurity.org
Exchange Client Access Servers
exchangeMDB/adsmsEXCAS01.adsecurity.org
Microsoft SCCM
CmRcService/adsmsSCCM01.adsecurity.org
Microsoft SCOM
MSOMHSvc/adsmsSCOM01.adsecurity.org
Sean Metcalf [@Pyrotek3 | [email protected]]
SPN Scanning for Services & Accounts

Sean Metcalf [@Pyrotek3 | [email protected]]

Cracking Service Account Passwords (Kerberoast)
Request/Save TGS service tickets & crack offline.
• “Kerberoast” - python-based TGS password
cracker.
• No elevated rights required.
• No traffic sent to target.
Kerberoast: Request TGS Service Ticket

Sean Metcalf [@Pyrotek3 | [email protected]]

Kerberoast: Save & Crack TGS Service Ticket

Sean Metcalf [@Pyrotek3 | [email protected]]

Kerberoast Detection
Detection is a lot tougher since requesting service tickets (Kerberos
TGS tickets) happens all the time when users need to access
resources.
Looking for TGS-REQ packets with RC4 encryption is probably the
best method, though false positives are likely.

Monitoring for numerous Kerberos service ticket requests in Active

Directory is possible by enabling Kerberos service ticket request
monitoring (“Audit Kerberos Service Ticket Operations”) and
searching for users with excessive 4769 events (Event Id 4769 “A
Kerberos service ticket was requested”).
Cracking Kerberos TGS Tickets Using Kerberoast – Exploiting Kerberos to Compromise the Active Directory Domain
https://adsecurity.org/?p=2293
Sean Metcalf [@Pyrotek3 | [email protected]]
12/2015
Kerberoast Detection Redux

Sean Metcalf [@Pyrotek3 | [email protected]]

Kerberoast Detection
• Event ID 4769
• Ticket Options: 0x40810000
• Ticket Encryption: 0x17
• Need to filter out service
accounts (Account Name) &
computers (Service Name).
• Inter-forest tickets use RC4
unless configured to use AES.
• ADFS also uses RC4.
Sean Metcalf [@Pyrotek3 | [email protected]]
Kerberoasting All User SPNs

Sean Metcalf [@Pyrotek3 | [email protected]]

Sean Metcalf [@Pyrotek3 | [email protected]]
Detection

Sean Metcalf [@Pyrotek3 | [email protected]]

Sean Metcalf [@Pyrotek3 | [email protected]]
Kerberoast Honeypot

Sean Metcalf [@Pyrotek3 | [email protected]]

Kerberoast Detection (Honeypot)

Sean Metcalf [@Pyrotek3 | [email protected]]

But wait, there’s more!

Sean Metcalf [@Pyrotek3 | [email protected]]

More Kerberoasting Fun!

Sean Metcalf [@Pyrotek3 | [email protected]]

More Kerberoasting Fun!

Sean Metcalf [@Pyrotek3 | [email protected]]

 Conclusion
• In the past, the industry has focused on getting as many
event IDs as possible (without effective focus).
• Tracking attacker activity is possible with the right logging.
• Most attacks follow similar patterns.
• “Kerberoasting” can be detected once 4769 events are
logged.
• Detection of “Kerberoasting” is increased through a “Service
Account Honeypot”.
Sean Metcalf (@Pyrotek3)
Thanks Jessica Payne! s e a n [@] TrimarcSecurity.com
www.ADSecurity.org
Slides: Presentations.ADSecurity.org TrimarcSecurity.com
Sean Metcalf [@Pyrotek3 | [email protected]]
References
• Monitoring what matters – Windows Event Forwarding for everyone (even if you already have a SIEM.)
https://blogs.technet.microsoft.com/jepayne/2015/11/23/monitoring-what-matters-windows-event-
forwarding-for-everyone-even-if-you-already-have-a-siem/
• PowerShell ♥ the Blue Team
http://blogs.msdn.com/b/powershell/archive/2015/06/09/powershell-the-blue-team.aspx
• PS>Attack
https://github.com/jaredhaight/PSAttack
• Invoke-Obfuscation
https://github.com/danielbohannon/Invoke-Obfuscation
• Events to monitor:
https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-ds/plan/appendix-l--events-to-
monitor
• Tracking Lateral Movement Part One – Special Groups and Specific Service Accounts
https://blogs.technet.microsoft.com/jepayne/2015/11/26/tracking-lateral-movement-part-one-
special-groups-and-specific-service-accounts/
• When the manual is not enough – runas /netonly, Unexpected Credential Exposure and the Need for
Reality Based Holistic Threat Models
https://blogs.technet.microsoft.com/jepayne/2016/04/04/when-the-manual-is-not-enough-runas-
netonly-unexpected-credential-exposure-and-the-need-for-reality-based-holistic-threat-models/
• Cracking Kerberos TGS Tickets Using Kerberoast – Exploiting Kerberos to Compromise the Active
Directory Domain
https://adsecurity.org/?p=2293
Sean Metcalf [@Pyrotek3 | [email protected]]
Appendix:
Auditing Subcategories to Event IDs

Sean Metcalf [@Pyrotek3 | [email protected]]

Auditing Subcategories to Events
Auditing Subcategory Event IDs
Audit Audit Policy Change 4719: System audit policy was changed.
4908: Special Groups Logon table modified.
Audit Authentication Policy Change 4706: A new trust was created to a domain.
4707: A trust to a domain was removed.
4713: Kerberos policy was changed.
4716: Trusted domain information was modified.
4717: System security access was granted to an account.
4718: System security access was removed from an account.
4739: Domain Policy was changed.
4865: A trusted forest information entry was added.
4866: A trusted forest information entry was removed.
4867: A trusted forest information entry was modified.
4706: A new trust was created to a domain.
4707: A trust to a domain was removed.
Audit Computer Account Management 4741: A computer account was created.
4742: A computer account was changed.
4743: A computer account was deleted.
Sean Metcalf [@Pyrotek3 | [email protected]]
Auditing Subcategories to Events
Auditing Subcategory Event IDs
Audit DPAPI Activity 4692: Backup of data protection master key was attempted.
4693: Recovery of data protection master key was attempted.
4695: Unprotection of auditable protected data was attempted.
Audit Kerberos Authentication Service 4768: A Kerberos authentication ticket (TGT) was requested
4771: Kerberos pre-authentication failed
4772: Kerberos authentication ticket request failed
Audit Kerberos Service Ticket Operation 4769: A Kerberos service ticket (TGS) was requested
4770: A Kerberos service ticket was renewed
Audit Logoff 4634: An account was logged off.
Audit Logon 4624: An account was successfully logged on.
4625: An account failed to log on.
4648: A logon was attempted using explicit credentials.
Audit Other Account Logon Events 4648: A logon was attempted using explicit credentials
4649: A replay attack was detected.
4800: The workstation was locked.
4801: The workstation was unlocked.
Sean Metcalf [@Pyrotek3 | [email protected]] 5378: The requested credentials delegation was disallowed by policy.
Auditing Subcategories to Events
Auditing Subcategory Event IDs
Audit Other Object Access Events 4698: A scheduled task was created.
4699: A scheduled task was deleted.
4702: A scheduled task was updated.
Audit Process Creation 4688: A new process has been created.
Audit Security Group Management 4728: A member was added to a security-enabled global group.
4729: A member was removed from a security-enabled global group.
4732: A member was added to a security-enabled local group.
4733: A member was removed from a security-enabled local group.
4735: A security-enabled local group was changed.
4737: A security-enabled global group was changed.
4755: A security-enabled universal group was changed.
4756: A member was added to a security-enabled universal group.
4757: A member was removed from a security-enabled universal group.
4764: A group's type was changed.
Audit Security System Extension 4610: An authentication package has been loaded by the Local Security
Authority.
4611: A trusted logon process has been registered with the Local
Security Authority.
Sean Metcalf [@Pyrotek3 | [email protected]] 4697: A service was installed in the system.
Auditing Subcategories to Events
Auditing Subcategory Event IDs
Audit Sensitive Privilege Use 4672: Special privileges assigned to new logon.
4673: A privileged service was called.
4674: An operation was attempted on a privileged object.
Audit Special Logon 4964: Special groups have been assigned to a new logon.
Audit User Account Management 4720: A user account was created.
4722: A user account was enabled.
4723: An attempt was made to change an account's password.
4724: An attempt was made to reset an account's password.
4725: A user account was disabled.
4726: A user account was deleted.
4738: A user account was changed.
4740: A user account was locked out.
4765: SID History was added to an account.
4766: An attempt to add SID History to an account failed.
4767: A user account was unlocked.
4780: The ACL was set on accounts which are members of
administrators groups.
Sean Metcalf [@Pyrotek3 | [email protected]]
4794: An attempt was made to set the Directory Services Restore Mode.