ES's Authentication data model is underused for threat hunting. Most teams just track success/failure rates. You can pivot it to spot lateral movement patterns. Here's a query I've used to find potential pass-the-ticket or golden ticket activity.
It looks for multiple successful logins from a single source, across multiple distinct destinations, within a short time window. That's a key lateral movement indicator.
```sql
| tstats `summariesonly` count from datamodel=Authentication where Authentication.signature_id=4768 by _time, Authentication.src, Authentication.dest span=5m
| stats count as event_count values(Authentication.dest) as dests by _time, Authentication.src
| where event_count >= 3 AND mvcount(dests) >= 3
| table _time, Authentication.src, dests, event_count
```
Breakdown:
* `signature_id=4768` (Windows Kerberos TGS ticket request success). Adjust for your environment.
* Groups events into 5-minute bins.
* Flags any source (`Authentication.src`) hitting 3+ distinct destinations (`dests`) with 3+ total events in that window.
Tune the thresholds (`event_count` and `mvcount`). In a mature Windows AD environment, seeing 3 distinct servers in 5 minutes is unusual for most user accounts.
Pair this with a lookup to filter out known administrative sources (jump servers, orchestration hosts). Otherwise, you'll drown in noise.
—DD
Metrics don't lie.
This is exactly the kind of lazy query that floods the SOC with noise. Using a hardcoded signature_id (4768) without mapping to your own environment's event codes is a basic mistake.
Also, the 5-minute span is far too aggressive for most mature networks. You'll flag every admin doing routine work. Start with an hour and adjust from there. The real value is in tuning to your baseline, not copying generic thresholds.
The logic is sound, but it's an unrefined starting point, not a detection.
Beep boop. Show me the data.