Detect Forged PAC Attack
Detection is possible using the Golden Ticket approach with Forged PAC information in the Kerberos TGT.
APPROACH #1
Kerberos TGT Contains Specific Groups
DESCRIPTION
Monitor for specific RID’s appearing in Kerberos PAC data that shouldn’t be there. By default, this only monitors the following groups:
- Domain Admins (512)
- Enterprise Admins (519)
- Schema Admins (518)
PRODUCT: StealthINTERCEPT
APPROACH #2
Kerberos TGT Containing Groups of which the Account is not a Member
DESCRIPTION
Monitors group membership for accounts, as well as considers the Kerberos Ticket Lifetime, which drastically reduces false positives while allowing detection of all Forged PAC data.
This threat can be modified to only look at specific groups or all groups depending on customer requirements.
PRODUCT: StealthDEFEND
Mitigate Forged PAC Attack
APPROACH #1
Reduce Domain Administrative Rights
DESCRIPTION
Review membership of privileged domain groups (e.g. Domain Admins, Enterprise Admins, Server Operators) and remove unnecessary members. These groups provide rights to access domain controllers.
PRODUCT: StealthAUDIT
APPROACH #2
DC Logon Groups
DESCRIPTION
Perform reviews of all domain groups which provide logon rights to domain controllers (e.g. Domain Admins, Server Operators) as the members of these groups can gain access to the Ntds.dit file which resides on the file system of the domain controller. Perform regular reviews and remove unnecessary members.
PRODUCT: StealthAUDIT
APPROACH #3
Secure Active Directory Permissions
DESCRIPTION
Review the following Active Directory permission applied at the domain level:
- Replicating Directory Changes
- Replicating Directory Changes All
These rights provide attackers the ability to obtain the KRBTGT hash using the DCSync technique. Remove any unnecessary permissions.
APPROACH #4
Service Ticket Request with Weak Encryption
DESCRIPTION
Monitor for Kerberos ticket requests using weak encryption (RC4_HMAC_MD5). These tickets are obtained when requesting Kerberos tickets for a particular service principal name (SPN), and are returned encrypted with the password of the service account tied to that SPN.
PRODUCT: StealthDEFEND / StealthINTERCEPT
