Service ticket request with a spoofed sAMAccountName
Synopsis
Activation Period
14 Days
Training Period
30 Days
Test Period
N/A (single event)
Deduplication Period
3 Hours
Required Data
Requires one of the following data sources: Windows Event Collector OR XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules
Identity Analytics
ATT&CK Tactic
Privilege Escalation (TA0004), Persistence (TA0003)
ATT&CK Technique
Account Manipulation (T1098), Valid Accounts (T1078)
Severity
Medium
Description
A Kerberos service ticket (ST) was requested for an account with a spoofed sAMAccountName.
Attacker's Goals
Elevate privileges from standard domain user to domain admin.
Investigative actions
Check if the domain controller is patched or vulnerable to the attack.
Look for associated sAMAccountName rename events.
Follow actions by the account and if it performed a DCSync.
Was this helpful?