<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-privileged-identity-threat-hunting
description: >-
  Hunt for compromised privileged identities through behavioral analytics, session anomaly detection, credential abuse patterns, and PAM log analysis. Covers Kerberoasting detection, golden/silver ticket identification, service account abuse, and just-in-time access violation hunting.
domain: cybersecurity
subdomain: identity-security
tags:
  - privileged-access
  - threat-hunting
  - PAM
  - kerberoasting
  - credential-abuse
  - behavioral-analytics
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  nist-csf:
  - "PR.AC-1"
  - "PR.AC-4"
  - "PR.AC-6"
  - "DE.CM-1"
  - "DE.CM-3"
  frameworks:
  - "MITRE ATT&CK"
  - "NIST SP 800-53"
  - "CIS Controls v8"
  mitre-attack: ["T1078.002"]
---

# Performing Privileged Identity Threat Hunting

## Overview

Privileged identity threat hunting proactively searches for indicators of
compromised administrative accounts, service accounts, and elevated access tokens.
It combines PAM telemetry, Active Directory logs, SIEM correlation, and behavioral
baselines to detect credential theft, lateral movement, and persistence mechanisms.

## Workflow

1. **Baseline Establishment** — Profile normal privileged account behavior (login times, source IPs, accessed systems)
2. **PAM Log Collection** — Aggregate session recordings, checkout logs, and command captures from PAM platforms
3. **Kerberos Analysis** — Hunt for Kerberoasting (TGS requests for SPNs), AS-REP roasting, and ticket anomalies
4. **Service Account Audit** — Identify interactive logons, password age violations, and excessive permissions
5. **Session Anomaly Detection** — Flag unusual session durations, concurrent sessions, and off-hours access
6. **Lateral Movement Correlation** — Map privileged credential use across systems to detect pass-the-hash/ticket
7. **Persistence Mechanism Hunt** — Search for golden/silver tickets, DCSync activity, and AdminSDHolder tampering
8. **Finding Documentation** — Document IOCs, timeline, and recommended containment actions

## Key Concepts

### Privileged Identity Attack Techniques

| Technique | ATT&CK ID | Detection Source | Indicator |
|-----------|----------|-----------------|-----------|
| Kerberoasting | T1558.003 | Security 4769 | RC4 TGS requests for service SPNs |
| AS-REP Roasting | T1558.004 | Security 4768 | Pre-auth disabled account requests |
| Golden Ticket | T1558.001 | Security 4769 | TGT with abnormal lifetime or SID |
| Silver Ticket | T1558.002 | Service logs | Service access without TGT request |
| DCSync | T1003.006 | Security 4662 | Replication rights from non-DC |
| Pass-the-Hash | T1550.002 | Security 4624 | NTLM logon type 9 from unusual source |
| Pass-the-Ticket | T1550.003 | Security 4768 | TGT use from non-issuing IP |

### Behavioral Baseline Dimensions

| Dimension | Normal Pattern | Anomaly Indicator |
|-----------|---------------|-------------------|
| Login Hours | Business hours (8-18) | Off-hours admin access |
| Source Network | Corporate VPN/office | Unknown IP or geo |
| Target Systems | Assigned infrastructure | First-time access to DCs |
| Session Duration | 15-60 minutes | Multi-hour sessions |
| Command Patterns | Standard admin tasks | Reconnaissance commands |
| Concurrent Sessions | 1-2 per admin | 5+ simultaneous |

### Service Account Risk Indicators

| Indicator | Risk Level | Action |
|-----------|-----------|--------|
| Interactive logon | Critical | Investigate immediately |
| Password > 365 days | High | Force rotation |
| Domain Admin membership | Critical | Remove, use JIT |
| No PAM management | High | Onboard to PAM |
| Unused > 90 days | Medium | Disable and monitor |

## Detection Opportunities

### Hunt Queries

**Kerberoasting Detection (KQL)**:
```
SecurityEvent
| where EventID == 4769
| where TicketEncryptionType == "0x17"  // RC4
| where ServiceName !endswith "$"
| summarize Count=count() by Account, ServiceName, IpAddress
| where Count > 3
```

**Off-Hours Privileged Access (SPL)**:
```
index=wineventlog EventCode=4624 LogonType=10
| eval hour=strftime(_time, "%H")
| where hour < 6 OR hour > 22
| stats count by Account_Name, Source_Network_Address
```

- **MITRE mapping**: T1558 (Steal or Forge Kerberos Tickets), T1003 (OS Credential Dumping), T1550 (Use Alternate Authentication Material)

```yaml
title: Privileged Identity Threat Hunting Detection
id: 0ee546d1-aa19-4710-b258-8c3df89184d4
status: experimental
description: Detects suspicious activity related to performing privileged identity threat hunting techniques in identity security context
logsource:
  category: authentication
  product: windows
detection:
  selection:
    EventType: authentication
    Status: failure
  condition: selection
level: high
tags:
  - attack.t1078.002
  - attack.credential_access
falsepositives:
  - Service account authentication during scheduled batch processing
```

