Bronze-Bit exploit
Synopsis
Field
Value
Activation Period
14 Days
Training Period
30 Days
Test Period
N/A (single event)
Deduplication Period
1 Day
Required Data
Requires one of the following data sources: Palo Alto Networks Firewall EAL Logs OR XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK Tactic
Execution (TA0002)
ATT&CK Technique
User Execution (T1204)
Severity
High
Description
A forwardable Kerberos ticket for delegation of a Protected User was observed.
Attacker's Goals
Gain a special user's Kerberos ticket to move laterally.
Investigative actions
Check the initiating service account delegation privileges.
Check the delegated account credentials and if it has high privileges.
Check the ticket destination to verify whether it is a sensitive asset.
Was this helpful?