Kerberoast Playbook

[Cyb3rWard0g]

Hey man a few things to update :

• Analytic(s) Relationships is not a field of the current format
• missing a few playbook tags (check current playbooks)
• Data analytics does not have a platform column name
• Data analytics only show SparkSQL queries to keep the language universal rather than cater to Kibana, splunk, MDATP. etc. too much to maintain. I believe that you use something like SIGMA rules to represent your queries and then those can be easily translated to the other analytic platforms
• Playbooks do not have Potential False Positives ( I believe that could be part of hunter notes). However, it might be added later as I get feedback from others in the industry
• Hunt Output is missing also from your playbook. Even if you do not have a SIGMA rule, have the title available to follow the format please.

[Cyb3rWard0g]

Regarding your Notebooks:

• You have a markdown error on the first cell
• Your query did not return anything
• Please follow the format used on every playbook notebook https://github.com/Cyb3rWard0g/ThreatHunter-Playbook/blob/master/playbooks/windows/02_execution/T1035_service_execution/remote_service_creation.ipynb
• playbooks are not tied to HELK so please follow the playbooks formats to read from the mordor dataset directly.

[jsecurity101]

@Cyb3rWard0g Updates that were necessary were made. Ready for review!

[Cyb3rWard0g]

hey @jsecurity101 , in the notebook, you have blind spots and false positives repeated. Also could you please match the font size for the titles? In the markdown, can you please make sure the data analytics table is shown as a table in a markdown preview?

Also in the markdown format, can you also update the titles font size please? You are missing a brief technical description. You can use the Library file to expand all the concepts, but you need a brief description to introduce the topic and the main concepts.

Suggestions:

• Looking for a service ticket (Not machine account or krbtgt) request with RC4 encryption type from a non machine account is very noisy in several environments. I would suggest to make this playbook more related to the detection of someone requesting a fake service ticket account. You can add in the description how you can create the fake account. For example: https://github.com/Cyb3rWard0g/mordor/blob/ca93d617f5b5a791cb7a67666a272dbf98602ea5/environment/shire/aws/scripts/DC/import-LOTR.ps1#L76 . Thats one of the easiest and most effective ways to detect the service ticket request action from a potential adversary. Also, I would change the name of the playbook to "Service Ticket Request for Fake SPN". Kerberoast concept covers also the process of cracking the Kerberos service tickets.
• Then, you can do another playbook to look for frequency of service ticket requests per user per minute. That should catch default basic scripts performing several requests for of all non-machine service tickets accounts available in the environment.