Host-Level Kerberos Log Extension for Pass-the-Ticket Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting Kerberos ticket reuse attacks, such as pass-the-ticket (PtT) attacks, is difficult due to their similarity with valid ticket behaviors, making user behavioral analysis (UEBA) heuristics unreliable, especially in environments with Active Directory delegation capabilities.
Innovation Solution
Implementing a ticket-granting log extension utility that collects and generates additional log data, including start, end, and renewal times, to compare user session names with client names, and extends this monitoring to network endpoints for accurate detection and prevention of ticket forgery attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If user behavioral analysis (UEBA) heuristics are used to detect pass-the-ticket attacks, then detection capability is improved, but reliability deteriorates because ticket reuse by other accounts or through VPN concentrators/NAT are expected behaviors
Solution Approach 1:
The patent segments the detection approach by separating ticket validation into multiple independent checks: (1) validating the ticket signature and expiration, (2) checking if the ticket is in the revoked tickets database, (3) verifying the client name matches the authenticated user account, and (4) confirming the source IP address matches the user's known IP. This segmentation allows each aspect to be validated independently, resolving the contradiction by providing reliable detection without relying on unreliable behavioral heuristics.
Solution Approach 2:
The patent introduces an intermediary component - a ticket validation service or module - that acts as a mediator between ticket presentation and resource access. This intermediary validates tickets through multiple checks including comparing client names with authenticated users and verifying source IP addresses, thereby providing reliable detection capability without being affected by the limitations of UEBA heuristics in delegated environments.
2Measurement precision
If additional log data collection and comparison mechanisms are implemented, then measurement precision is improved, but device complexity increases
Solution Approach 1:
The patent implements a universal ticket validation mechanism that serves multiple functions: validating ticket authenticity, checking revocation status, verifying client name matching, and confirming source IP address validity. By creating a multi-functional validation system, the patent achieves high measurement precision for detecting ticket forgery without proportionally increasing complexity, as the same validation infrastructure handles multiple security checks.
Solution Approach 2:
The patent performs preliminary actions by pre-populating a revoked tickets database with invalid or compromised ticket information before validation occurs. This preliminary preparation allows the validation system to quickly compare presented tickets against known bad tickets, improving measurement precision without adding complex real-time analysis capabilities during the actual validation process.
Data Source
AI summary
A system and method for detection and prevention of ticket forgery cyberattacks by improving host-level analytics and monitoring and extending the improved host-level analytics and monitoring to endpoints of a network. The methodology described herein comprises the use of a ticket-granting log extension utility which stores every logon session on a network, queries the local ticket cache, and generates additional custom data as a part of an event log stream such as a start time, end time, renew time, and related session data. This comprehensive log extension data can be used to identify certain types of ticket forgery cyberattacks by comparing the user session name with the client name identified in the ticket presented for access to network resources and other means. This host-level ticket forgery detection can be extended to network endpoints for additional security.