“In this Very Easy Sherlock, players will go through artefacts and logs from the Domain controller as well as endpoint artefacts from where Kerberoast attack activity was sourced. Players will work through what to look for to identify kerberoasting attack activity and to avoid false positives due to the complexity of Active Directory.”
Alonzo Spotted Weird files on his computer and informed the newly assembled SOC Team. Assessing the situation it is believed a Kerberoasting attack may have occurred in the network. It is your job to confirm the findings by analyzing the provided evidence.
For this Sherlock, I will be working on the Windows Pwnbox.
- Analyzing Domain Controller Security Logs, can you confirm the UTC date & time when the kerberoasting activity occurred?
Using the following article as a reference, we should be looking at logs with the following characteristics:
- Event ID 4769 (“A Kerberos service ticket was requested”)
- Ticket Encryption: 0x17 (downgrading to RC4 encryption)
- Account name does NOT end with an
$(possibly a service account).
After filtering logs on Event Viewer to Event ID 4769 and looking for the '0x17', we can find our first log showing signs of possible Kerberoasting at 3:18:09AM:
- What is the Service Name that was targeted?
We can find our answer in the log displayed above inside the ServiceName field.
- It is really important to identify the Workstation from which this activity occurred. What is the IP Address of the workstation?
We can find our answer in the log displayed above inside the IpAddress field.
- Now that we have identified the workstation, a triage including PowerShell logs and Prefetch files are provided to you for some deeper insights so we can understand how this activity occurred on the endpoint. What is the name of the file used to Enumerate Active directory objects and possibly find Kerberoastable accounts in the network?
Let's check the Powershell-Operational.evtx logs on Event Viewer. We will be immediately met with plenty of Warning logs, which look suspicious. Some of these logs are about Creating Scriptblock text, which eventually lead to the name of the file used for AD enumeration:
- When was this script executed? (UTC)
Looking back at the Scriptblock logs, we can note down the first timestamp of the first event and submit it as timestamp for when the script was executed:
- What is the full path of the tool used to perform the actual kerberoasting attack?
After doing some research on how to analyze Prefetch files, I realized I could use Eric Zimmerman's PECmd. I downloaded PECmd from this website and parsed through all the files:
.\PECmd.exe -d "C:\Users\hiramf0\Downloads\campfire-1\Triage\Workstation\2024-05-21T033012_triage_asset\C\Windows\prefetch\" --html "C:\Users\hiramf0\Downloads\campfire-1\prefetch-results.html"A common tool used for Kerberoasting and other AD attacks is called Rubeus. Could this tool be in the logs? I opened the PECmd.exe output and used CTRL+F to find Rubeus:
It seems this is the tool the attacker must've used for Kerberoasting! Looking carefully into the directories related to this file, we can find a user-owned directory from where the file was ran:
Assuming that the VOLUME name in the file path is C, we can construct our full file path by adding the letter drive behind \Users\ .
- When was the tool executed to dump credentials? (UTC)
We can find our answer in the Last Run field in the pictures above.