社内ネットワーク侵入後の「管理者権限奪取（Kerberoasting / Pass-the-Hash）」はどう起きるか？
最小権限とセグメント分離の鉄則

#![forbid(unsafe_code)]

use std::collections::{HashMap, HashSet};

/// Kerberos Encryption Types per RFC 3961 / RFC 4757 / RFC 3962.
pub const ETYPE_RC4_HMAC: u16 = 0x0017;
pub const ETYPE_AES128_CTS_HMAC_SHA1_96: u16 = 0x0011;
pub const ETYPE_AES256_CTS_HMAC_SHA1_96: u16 = 0x0012;

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum AdminTier {
    Tier0DomainControl,
    Tier1ServerFleet,
    Tier2Workstation,
}

#[derive(Debug, Clone)]
pub struct AuthTelemetryEvent {
    pub timestamp_sec: u64,
    pub source_ip: u32,
    pub target_host_id: u32,
    pub account_sid_rid: u32,
    pub account_tier: AdminTier,
    pub target_tier: AdminTier,
    pub event_id: u16,              // 4769 (TGS-REQ) or 4624 (Logon)
    pub kerberos_etype: u16,        // Valid when event_id == 4769
    pub is_ntlm_network_logon: bool,
    pub spn_requested: bool,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub enum ThreatSignal {
    KerberoastingRc4Downgrade { source_ip: u32, spn_burst_count: usize },
    CrossTierPrivilegeViolation { account_rid: u32, from: AdminTier, to: AdminTier },
    PassTheHashLateralFanOut { source_ip: u32, distinct_targets: usize },
}

pub struct LateralMovementDetector {
    tgs_spn_history: HashMap<u32, Vec<u64>>,
    ntlm_target_fanout: HashMap<u32, HashSet<u32>>,
    window_sec: u64,
}

impl LateralMovementDetector {
    #[must_use]
    pub fn new(window_sec: u64) -> Self {
        Self {
            tgs_spn_history: HashMap::new(),
            ntlm_target_fanout: HashMap::new(),
            window_sec,
        }
    }

    /// Evaluates an incoming AD authentication telemetry event for privilege escalation & lateral movement.
    pub fn inspect_event(&mut self, ev: &AuthTelemetryEvent) -> Vec<ThreatSignal> {
        let mut signals = Vec::new();

        // 1. Enforce strict Tier boundary: Tier 0 credentials must NEVER authenticate to Tier 2 workstations
        if ev.account_tier == AdminTier::Tier0DomainControl && ev.target_tier == AdminTier::Tier2Workstation {
            signals.push(ThreatSignal::CrossTierPrivilegeViolation {
                account_rid: ev.account_sid_rid,
                from: ev.account_tier,
                to: ev.target_tier,
            });
        }

        // 2. Detect Kerberoasting (Event 4769 with RC4-HMAC etype 0x17 against SPNs)
        if ev.event_id == 4769 && ev.spn_requested && ev.kerberos_etype == ETYPE_RC4_HMAC {
            let timestamps = self.tgs_spn_history.entry(ev.source_ip).or_default();
            timestamps.push(ev.timestamp_sec);
            let cutoff = ev.timestamp_sec.saturating_sub(self.window_sec);
            timestamps.retain(|&t| t >= cutoff);

            if timestamps.len() >= 3 {
                signals.push(ThreatSignal::KerberoastingRc4Downgrade {
                    source_ip: ev.source_ip,
                    spn_burst_count: timestamps.len(),
                });
            }
        }

        // 3. Detect Pass-the-Hash lateral fan-out (Event 4624 Type 3 NTLM with local admin RID 500)
        if ev.event_id == 4624 && ev.is_ntlm_network_logon && ev.account_sid_rid == 500 {
            let targets = self.ntlm_target_fanout.entry(ev.source_ip).or_default();
            targets.insert(ev.target_host_id);
            if targets.len() >= 2 {
                signals.push(ThreatSignal::PassTheHashLateralFanOut {
                    source_ip: ev.source_ip,
                    distinct_targets: targets.len(),
                });
            }
        }

        signals
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn detects_rc4_kerberoasting_and_tier_violation() {
        let mut detector = LateralMovementDetector::new(60);
        for i in 0..3 {
            let ev = AuthTelemetryEvent {
                timestamp_sec: 1000 + i,
                source_ip: 0x0A00_0115,
                target_host_id: 1,
                account_sid_rid: 1104,
                account_tier: AdminTier::Tier2Workstation,
                target_tier: AdminTier::Tier0DomainControl,
                event_id: 4769,
                kerberos_etype: ETYPE_RC4_HMAC,
                is_ntlm_network_logon: false,
                spn_requested: true,
            };
            let alerts = detector.inspect_event(&ev);
            if i == 2 {
                assert_eq!(alerts.len(), 1);
            }
        }
    }
}