Problems with krb5 parser

Rules
1

I have pcap file with preauth kerberoasting

sname-test.pcap (4.4 KB)

And signature like this
alert krb5 any any -> any any (msg:"Kerberoasting attack with non-preauth"; krb5_msg_type:10; krb5_sname; content:!"krbtgt"; content:!"changepw"; sid:1;)

I want to match AS-REQ with sname not in [krbtgt, changepw], but this rule doesnot work for some reason

I also try like this and it does not work

alert krb5 any any -> any any (msg:"Kerberoasting attack with non-preauth"; krb5_msg_type:10; krb5_sname; content:"hacker"; sid:1;)

But trying to match just krb5_msg_type or krb5_sname works perfectly

I have event that i need in eve log

image
image1444×174 53.5 KB

eve-sname-test.json (14.6 KB)

Stat logs
stats-sname-test.log (4.8 KB)

2

If I remove krb5_msg_type:10; from the signature the alert triggers.

3

Yes

Removing krb5_msg_type produce 1 alert
Removing krb5_sname produce 7 alerts

This part work as expected

But combining them does not for some reason (

4

Yeah, it seems they all work separately but not in combination.


suricata  -S tmp.rules  -l logs/ -k none -r sname-test.pcap -v --set "stream.midstream=true" ; jq -r .event_type logs/eve.json | sort | uniq -c |sort -rn ; grep '"event_type":"alert"' logs/eve.json | jq .alert.signature | sort -rn | uniq -c | sort -rn

Notice: suricata: This is Suricata version 8.0.2 RELEASE running in USER mode
Info: cpu: CPUs/cores online: 16
Info: suricata: Setting engine mode to IDS mode by default
Info: exception-policy: master exception-policy set to: auto
Info: logopenfile: fast output device (regular) initialized: fast.log
Info: logopenfile: eve-log output device (regular) initialized: eve.json
Info: logopenfile: stats output device (regular) initialized: stats.log
Info: detect: 1 rule files processed. 6 rules successfully loaded, 0 rules failed, 0 rules skipped
Info: threshold-config: Threshold config parsed: 0 rule(s) found
Info: detect: 6 signatures processed. 0 are IP-only rules, 0 are inspecting packet payload, 6 inspect application layer, 0 are decoder event only
Notice: mpm-hs: Rule group caching - loaded: 0 newly cached: 2 total cacheable: 2
Info: pcap: Starting file run for sname-test.pcap
Info: pcap: pcap file sname-test.pcap end of file reached (pcap err code 0)
Notice: threads: Threads created -> RX: 1 W: 16 FM: 1 FR: 1   Engine started.
Notice: suricata: Signal Received.  Stopping engine.
Info: suricata: time elapsed 0.090s
Notice: pcap: read 1 file, 14 packets, 4264 bytes
Info: counters: Alerts: 9
     14 krb5
      9 alert
      7 flow
      1 stats
      1 anomaly
      7 "Kerberoasting attack with non-preauth - 10"
      1 "Kerberoasting attack with non-preauth - hacker"
      1 "Kerberoasting attack with - kartunchikov "

cat  tmp.rules 

alert krb5 any any -> any any (msg:"Kerberoasting attack with non-preauth - 10/hacker"; krb5_msg_type:10; krb5.sname; content:"hacker"; sid:1;)
alert krb5 any any -> any any (msg:"Kerberoasting attack with non-preauth - hacker";  krb5.sname; content:"hacker"; sid:2;)
alert krb5 any any -> any any (msg:"Kerberoasting attack with  - 10/kartunchikov"; krb5_msg_type:10; krb5.cname; content:"a.kartunchikov"; sid:3;)
alert krb5 any any -> any any (msg:"Kerberoasting attack with - kartunchikov ";  krb5.cname; content:"kartunchikov"; sid:4;)
alert krb5 any any -> any any (msg:"Kerberoasting attack with non-preauth - 10"; krb5_msg_type:10; sid:5;)
alert krb5 any any -> any any (msg:"Kerberoasting attack with non-preauth - hacker/10"; krb5.sname; content:"hacker"; krb5_msg_type:10; sid:6;)

Can you please open a bug ticket for that on our redmine and point to the discussion here?
Suggestion: If you need to alert on both matches maybe you can utilize flowbits. Otherwise a regular SIEM query would highlight both :slight_smile: - something like

krb5_msg_type:10 and krb5.sname:"hacker" and krb5.cname:"a.kartunchikov"
1 Like
5

This is because `krb5_sname` only works to client.

The doc 8.26. Kerberos Keywords — Suricata 9.0.0-dev documentation states

Kerberos server name, provided in the ticket (for AS-REQ and TGS-REQ messages) or in the error message.

But it looks to only work for the error message, as enforced by SV test krb5-request-frag-log

I think this is a bug and fix would be simply


diff --git a/src/detect-krb5-sname.c b/src/detect-krb5-sname.c
index 3cbe6185bb..93c499cda2 100644
--- a/src/detect-krb5-sname.c
+++ b/src/detect-krb5-sname.c
@@ -62,6 +62,8 @@ void DetectKrb5SNameRegister(void)
 
     DetectAppLayerMultiRegister(
             "krb5_sname", ALPROTO_KRB5, SIG_FLAG_TOCLIENT, 1, SCKrb5TxGetSname, 2);
+    DetectAppLayerMultiRegister(
+            "krb5_sname", ALPROTO_KRB5, SIG_FLAG_TOSERVER, 1, SCKrb5TxGetSname, 2);
 
     DetectBufferTypeSetDescriptionByName("krb5_sname",
             "Kerberos 5 ticket server name");
6

Did someone create a ticket yet?

7

I just did here -