Sigma rule: DC Machine Account TGS Request from Non-DC Source IP

Rule

Title

DC Machine Account TGS Request from Non-DC Source IP

Status

experimental

Level

high

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2026-07-29

File

rules-placeholder/windows/builtin/security/win_security_dc_machine_account_tgs_non_dc_ip.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects a Kerberos service ticket request (Event 4769) targeting a Domain Controller
machine account's service (e.g. DRSUAPI) originating from an IP address that is not a
known Domain Controller. Service tickets for DC machine accounts should only be requested
by other DCs during legitimate replication operations.

An attacker with a valid TGT (obtained via PKINIT, overpass-the-hash, or stolen TGT)
targeting a DC machine account's service from a workstation IP indicates preparation for
DCSync or impersonation of a DC. Unlike Silver Ticket attacks (which forge the TGS and
bypass this event), this rule catches attacks that go through the KDC legitimately.

This rule requires %dc_machine_accounts% and %dc_ip_addresses% to be populated with
all known DC machine account names and DC IP addresses respectively.

Log source

product

windows

service

security

Detection

selection:
    EventID: 4769
    Status: '0x0'
    ServiceName|endswith: '$'
    ServiceName|expand: '%dc_machine_accounts%' # should be populated with all known DC machine account names
filter_main_dc_source:
    IpAddress|expand: '%dc_ip_addresses%'
filter_main_loopback:
    - IpAddress:
          - '127.0.0.1'
          - '::1'
          - '::ffff:127.0.0.1'
          - '-'
    - IpAddress|startswith: 'fe80:'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Unlikely

Tags

• attack.credential-access
• attack.lateral-movement
• attack.t1550.003
• attack.t1558.003
• cve.2026-54121

CVEs this rule names

• CVE-2026-54121

MITRE ATT&CK ids this rule names

• T1550.003
• T1558.003

References

• https://github.com/aniqfakhrul/CVE-2026-54121
• https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54121
• https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4769

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-placeholder/windows/builtin/security/win_security_dc_machine_account_tgs_non_dc_ip.yml