SPNs cleared from a machine account

Supported Cortex XSOAR versions: 8.9.0 and later.

This playbook addresses the following alerts:

Playbook Stages:

Triage:

Retrieve additional data about the Account Changed event, including the Machine Account whose SPNs were cleared and the number of times the user cleared SPNs in the last 30 days.

Investigation:

Search for creation of suspicious account on the Domain Controller.
Search for suspicious TGT/Service ticket requests.
Search for user insights associated with malicious tools related to Kerberos ticket manipulation.
Search for suspicious account renames, particularly to mimic DC name.
Search for additional alerts in the incident that could indicate attempts to find controlled accounts or create accounts.

Containment:

For alerts determined to be true positives, prompt the analyst to decide whether to disable the user account.
Upon analyst approval: Disable the suspicious user account in Active Directory.

Requirements:

For response actions, you need the following integrations:

Dependencies#

This playbook uses the following sub-playbooks, integrations, and scripts.

This playbook does not use any sub-playbooks.

This playbook does not use any integrations.

There are no inputs for this playbook.

There are no outputs for this playbook.

SPNs cleared from a machine account