Sigma rule: DC Machine Account TGT Request from Non-DC Source IP

Rule

Title

DC Machine Account TGT Request from Non-DC Source IP

Status

experimental

Level

high

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2026-07-29

File

rules-placeholder/windows/builtin/security/win_security_dc_machine_accoutn_tgt_non_dc_ip.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects a Kerberos TGT request (Event 4768) for a known Domain Controller machine account
originating from an IP address that is not a known Domain Controller. DC machine accounts
should only request TGTs from their own IP. Any TGT request for a DC account from a
workstation or non-DC host is anomalous and indicates one of the following:

- PKINIT abuse (CVE-2026-54121 / Certighost): attacker authenticating as a DC via a
forged certificate from their workstation
- Overpass-the-Hash: attacker converting a stolen DC machine account NTLM hash into a
Kerberos TGT
- Pass-the-Hash (RC4): attacker using the DC machine account hash directly with Kerberos

Log source

product

windows

service

security

Detection

selection:
    EventID: 4768
    Status: '0x0'
    TargetUserName|endswith: '$'
    TargetUserName|expand: '%dc_machine_accounts%'
filter_main_dc_source:
    IpAddress|expand: '%dc_ip_addresses%'
filter_main_loopback:
    - IpAddress:
          - '127.0.0.1'
          - '::1'
          - '::ffff:127.0.0.1'
          - '-'
    - IpAddress|startswith: 'fe80:'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Unlikely if %dc_machine_accounts% and %dc_ip_addresses% are correctly populated.

Tags

• attack.credential-access
• attack.lateral-movement
• attack.t1649
• attack.t1550.003
• attack.t1558.001
• cve.2026-54121

CVEs this rule names

• CVE-2026-54121

MITRE ATT&CK ids this rule names

• T1550.003
• T1558.001
• T1649

References

• https://github.com/aniqfakhrul/CVE-2026-54121
• https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-placeholder/windows/builtin/security/win_security_dc_machine_accoutn_tgt_non_dc_ip.yml