From: Philippe Antoine Date: Tue, 12 Jul 2022 07:21:36 +0000 (+0200) Subject: Adds test for kerberos ticket_encryption X-Git-Tag: suricata-6.0.8~28 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=aefbdb638588b1911ecd5bd3f9041f2547c6c734;p=thirdparty%2Fsuricata-verify.git Adds test for kerberos ticket_encryption --- diff --git a/tests/krb5-kerberoasting/README.md b/tests/krb5-kerberoasting/README.md new file mode 100644 index 000000000..47a92e70e --- /dev/null +++ b/tests/krb5-kerberoasting/README.md @@ -0,0 +1,3 @@ +Test krb5 ticket encryption feature + +Pcap from https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting diff --git a/tests/krb5-kerberoasting/kerberoast.pcap b/tests/krb5-kerberoasting/kerberoast.pcap new file mode 100644 index 000000000..62063950f Binary files /dev/null and b/tests/krb5-kerberoasting/kerberoast.pcap differ diff --git a/tests/krb5-kerberoasting/test.rules b/tests/krb5-kerberoasting/test.rules new file mode 100644 index 000000000..585c2baff --- /dev/null +++ b/tests/krb5-kerberoasting/test.rules @@ -0,0 +1,3 @@ +alert krb5 any any -> any any (krb5.ticket_encryption: weak; sid:1;) +alert krb5 any any -> any any (krb5.ticket_encryption: 23; sid:2;) +alert krb5 any any -> any any (krb5.ticket_encryption: rc4-hmac; sid:3;) diff --git a/tests/krb5-kerberoasting/test.yaml b/tests/krb5-kerberoasting/test.yaml new file mode 100644 index 000000000..bd5ba8a3f --- /dev/null +++ b/tests/krb5-kerberoasting/test.yaml @@ -0,0 +1,33 @@ +requires: + min-version: 7 + +args: + - -k none + +checks: + - filter: + count: 0 + match: + event_type: anomaly + - filter: + count: 1 + match: + event_type: krb5 + krb5.msg_type: KRB_TGS_REP + krb5.ticket_encryption: rc4-hmac + krb5.ticket_weak_encryption: true + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 2 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 3