PKINIT Followed by Same-Principal U2U Service Ticket

Last updated 5 days ago on 2026-08-13

Created 5 days ago on 2026-08-13

About

Identifies a successful PKINIT ticket-granting ticket request followed within five seconds on the same domain controller and source address by a successful user-to-user service-ticket request whose service SID matches the PKINIT principal SID. This sequence is consistent with the KDC-visible ticket requests used in an UnPAC-the-Hash attack, before client-side PAC credential decryption and NT hash recovery. The certificate used for PKINIT may have been obtained through CertiGhost or another certificate-abuse path.

Tags

Domain: IdentityPlatform: WindowsOS: WindowsUse Case: Threat DetectionTactic: Credential AccessRule Type: Event Correlation (EQL)Use Case: Active Directory MonitoringData Source: Active DirectoryData Source: Windows Security Event LogsLanguage: eql

Severity

medium

Risk Score

MITRE ATT&CK™

Credential Access (TA0006)(external, opens in a new tab or window)

↳ Steal or Forge Kerberos Tickets (T1558)(external, opens in a new tab or window)

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type

Event Correlation Rule

Integration Pack

Prebuilt Security Detection Rules

Index Patterns

logs-system.security*logs-windows.forwarded*winlogbeat-*

Related Integrations

system(external, opens in a new tab or window)

windows(external, opens in a new tab or window)

Query

✄𐘗text code block:
✄𐘗sequence by winlog.computer_name, source.ip with maxspan=5s
  [authentication where host.os.type == "windows" and
    event.code == "4768" and winlog.event_data.PreAuthType == "16" and
    winlog.event_data.Status == "0x0"
  ] by winlog.event_data.TargetSid
  [authentication where host.os.type == "windows" and
    event.code == "4769" and winlog.event_data.Status == "0x0" and
    winlog.event_data.TicketOptions in ("0x40810008", "0x40810018")
  ] by winlog.event_data.ServiceSid

Install detection rules in Elastic Security

Detect PKINIT Followed by Same-Principal U2U Service Ticket in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).