Threat Hunting Exercise: Analyzing Windows Rubeus OverPassTheHash Ticket Renewal Dataset
This hunt uses a simulated domain-controller security event dataset (win_security_rubeus_optH_2022-09-02T090000.json) capturing T1550.003: Use Alternate Authentication Material (Pass the Ticket) / Overpass-the-Hash, where an attacker converts a captured NTLM hash into a full Kerberos TGT using Rubeus, bypassing the need for a plaintext password.
Step 1: Hypothesis Formation
Hypothesis: A workstation requests a Kerberos TGT (Event ID 4768) using RC4 encryption (etype 0x17) for a privileged account immediately after that account authenticated interactively elsewhere via NTLM, with the requesting host never having an interactive logon history for that account - consistent with Rubeus asktgt using a stolen hash. Indicators:
- Event ID 4768 (TGT request) with Ticket Encryption Type
0x17(RC4-HMAC) on an environment that otherwise enforces AES (0x12/0x11) via Kerberos policy. - The requesting workstation has no prior 4624 interactive logon for the target account.
- A short-lived, unusually long-lifetime or renewable ticket flag pattern typical of Rubeus-crafted requests.
- Immediately followed by 4769 (service ticket) requests to multiple SPNs from the same host, suggesting the TGT is being used for lateral movement.
Null Hypothesis: A legacy application or service account genuinely requires RC4 due to compatibility constraints, and the host is a known jump box for that account. Invalidate by confirming the host against approved service-account authentication mappings and change-management records.
Rationale: Because AES-only environments are supposed to eliminate silent NTLM-hash reuse, a lone RC4 TGT request is a strong outlier signal; catching it at the ticket-request stage is far cheaper than remediating after lateral movement.
Step 2: Data Sources and Scope
- Sources: Domain Controller Security event logs (4768, 4769, 4624, 4634); Sysmon Event ID 1 (process creation) on the source workstation; EDR command-line telemetry.
- Scope: ~2022-09-02T09:00:00-09:45:00 UTC; Host: WKS-ENG-014 (10.40.12.33); Target account:
svc-backup-admin. - SIEM Queries (Splunk/ELK):
index=wineventlog EventCode=4768 Ticket_Encryption_Type="0x17" | stats count by Account_Name, Client_Address- Prior-logon check:
index=wineventlog EventCode=4624 Account_Name="svc-backup-admin" | stats values(Workstation_Name) as prior_hosts - Follow-on lateral movement:
index=wineventlog EventCode=4769 Account_Name="svc-backup-admin" earliest=-10m
Step 3: Key Findings
Parsed events (5 shown) confirm WKS-ENG-014 requested an RC4 TGT for svc-backup-admin - an account with no prior interactive logon history on that host - followed immediately by service ticket requests against three separate file and SQL servers.
| Timestamp (UTC) | Host | Event | Detail | IOC/Why Suspicious? |
|---|---|---|---|---|
| 2022-09-02 09:12:07 | DC01 | 4768 (TGT Request) | Account svc-backup-admin, Client WKS-ENG-014, Ticket_Encryption_Type 0x17 (RC4) | Downgrade IOC: environment Kerberos policy enforces AES; an RC4 request is a strong Overpass-the-Hash indicator (Rubeus default behavior when only NTLM hash is available). |
| 2022-09-02 09:12:07 | DC01 | (correlation) | No prior 4624 interactive/RDP logon exists for svc-backup-admin on WKS-ENG-014 in the preceding 30 days | Host-Mismatch IOC: the account has never logged on interactively to this workstation, ruling out normal cached-credential use. |
| 2022-09-02 09:12:41 | DC01 | 4769 (Service Ticket) x3 | SPNs for FS02, SQL01, SQL03 requested within 34 seconds using the same TGT | Lateral-Movement IOC: rapid multi-target service ticket requests from a single TGT match automated pass-the-ticket tooling, not manual admin work. |
| 2022-09-02 09:11:52 | WKS-ENG-014 | Sysmon Event ID 1 | rubeus.exe asktgt /user:svc-backup-admin /rc4:<hash> /ptt launched from C:\Users\Public\r.exe | Tooling IOC: direct evidence of Rubeus execution with an embedded NTLM hash and /ptt (pass-the-ticket) flag. |
| 2022-09-02 09:05:14 | WKS-ENG-014 | (EDR credential access alert) | LSASS memory read by unsigned process 12 minutes prior to the TGT request | Precursor IOC: hash was very likely harvested from this host's LSASS moments before being weaponized. |
Validation:
- Timeline: LSASS credential access, immediately followed by an RC4 TGT request for an unrelated privileged account, immediately followed by multi-target service ticket abuse - a complete Overpass-the-Hash attack chain.
- False Positives: no change ticket references RC4 fallback for this account; the executable is unsigned and located in a non-standard path.
- Correlation: credential theft, protocol downgrade, host mismatch, and lateral-movement ticket bursts jointly confirm malicious activity.
Step 4: Recommendations & Next Steps
- Immediate Response: Disable
svc-backup-admin, force a password/hash reset (RC4 hashes must be invalidated by password change, not just a Kerberos ticket purge), isolate WKS-ENG-014, and revoke all outstanding tickets via KRBTGT-aware session termination if compromise is broader. - Detection: Sigma-style rule:
title: Kerberos RC4 TGT Request in AES-Enforced Environment→selection: EventID=4768 AND TicketEncryptionType=0x17filter: known_legacy_accounts→condition: selection and not filter. - Pro Tip: Baseline and alert on any 4768 event where
Ticket_Encryption_Typeis 0x17 in environments with AES-only Kerberos policy - this single field is one of the highest-fidelity, lowest-noise indicators of Pass/Overpass-the-Hash activity available in default DC logging.
Hypothesis confirmed - an attacker harvested an NTLM hash from WKS-ENG-014 via LSASS access and used Rubeus to forge a Kerberos TGT for a privileged service account, enabling lateral movement to three servers within seconds!