mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Branch was auto-updated.
This commit is contained in:
Bhavin Patel
@@ -0,0 +1,101 @@
|
||||
name: Potential Pass the Token or Hash Observed at the Destination Device
|
||||
id: 82e76b80-5cdb-4899-9b43-85dbe777b36d
|
||||
version: 1
|
||||
date: '2021-09-01'
|
||||
author: Stanislav Miskovic, Splunk
|
||||
type: TTP
|
||||
datamodel: []
|
||||
description: This detection identifies potential Pass the Token or Pass the Hash credential exploits. We detect the main side effect of these attacks, which is a transition from the dominant Kerberos logins to rare NTLM logins for a given user, as reported by a detination device.
|
||||
|
||||
search: '| from read_ssa_enriched_events()
|
||||
| eval timestamp= parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"), "string", null)),
|
||||
dest_user_id= lower(ucast(map_get(input_event, "dest_user_id"), "string", null)),
|
||||
dest_device_id= lower(ucast(map_get(input_event, "dest_device_id"), "string", null)),
|
||||
signature_id= lower(ucast(map_get(input_event, "signature_id"), "string", null)),
|
||||
authentication_method= lower(ucast(map_get(input_event, "authentication_method"), "string", null))
|
||||
|
||||
| where signature_id = "4624" AND
|
||||
(authentication_method="ntlmssp" OR authentication_method="kerberos") AND
|
||||
dest_user_id != null AND
|
||||
dest_device_id != null
|
||||
|
||||
| eval isKerberos=if(authentication_method == "kerberos", 1, 0),
|
||||
isNtlm=if(authentication_method == "ntlmssp", 1, 0),
|
||||
timeNTLM=if(isNtlm > 0, timestamp, null)
|
||||
|
||||
| stats sum(isKerberos) as totalKerberos,
|
||||
sum(isNtlm) as totalNtlm,
|
||||
min(timestamp) as startTime,
|
||||
min(timeNTLM) as startNTLMTime,
|
||||
max(timestamp) as endTime,
|
||||
max(timeNTLM) as endNTLMTime by dest_user_id, dest_user, dest_device_id, span(timestamp, 86400s)
|
||||
|
||||
| where NOT dest_user="-" AND
|
||||
totalKerberos > 0 AND
|
||||
totalNtlm > 0 AND
|
||||
endTime - startTime > 1800000 AND
|
||||
(totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND
|
||||
(endTime - startTime) > 3 * (endNTLMTime - startNTLMTime)
|
||||
|
||||
| eval start_time=ucast(startNTLMTime, "long", null),
|
||||
end_time=ucast(endNTLMTime, "long", null),
|
||||
entities=mvappend(dest_user_id, dest_device_id),
|
||||
body=create_map(["total_kerberos", totalKerberos,
|
||||
"total_ntlm", totalNtlm,
|
||||
"analysis_start_time", startTime,
|
||||
"analysis_end_time", endTime,
|
||||
"pth_start_time", startNTLMTime,
|
||||
"pth_end_time", endNTLMTime])
|
||||
|
||||
| into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from endpoint devices, i.e., destinations of interest. Please make sure that event ID 4624 is being logged.
|
||||
known_false_positives: Environments in which NTLM is used extremely rarely and for benign purposes (such as a rare use of SMB shares).
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1550/002/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Lateral Movement
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 90
|
||||
impact: 80
|
||||
risk_score: 72
|
||||
risk_severity: high
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
- Stage:Lateral Movement
|
||||
kill_chain_phases:
|
||||
- Lateral Movement
|
||||
message: Potential lateral movement and credential stealing via Pass the Token or Pass the Hash techniques. Operation is
|
||||
performed via credentials of the account $dest_user_id$ and observed by the destination device $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1550.002
|
||||
nist:
|
||||
- PR.PT
|
||||
- PR.AT
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Actor
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Other
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- signature_id
|
||||
- dest_user
|
||||
- dest_user_id
|
||||
- dest_device_id
|
||||
- authentication_method
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,101 @@
|
||||
name: Potential Pass the Token or Hash Observed by an Event Collecting Device
|
||||
id: 1058ba3e-a698-49bc-a1e5-7cedece4ea87
|
||||
version: 1
|
||||
date: '2021-09-01'
|
||||
author: Stanislav Miskovic, Splunk
|
||||
type: TTP
|
||||
datamodel: []
|
||||
description: This detection identifies potential Pass the Token or Pass the Hash credential exploits. We detect the main side effect of these attacks, which is a transition from the dominant Kerberos logins to rare NTLM logins for a given user, as reported by an event-collecting device (i.e., a specific domain controller or an endpoint destination).
|
||||
|
||||
search: '| from read_ssa_enriched_events()
|
||||
| eval timestamp= parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"), "string", null)),
|
||||
dest_user_id= lower(ucast(map_get(input_event, "dest_user_id"), "string", null)),
|
||||
origin_device_id= lower(ucast(map_get(input_event, "origin_device_id"), "string", null)),
|
||||
signature_id= lower(ucast(map_get(input_event, "signature_id"), "string", null)),
|
||||
authentication_method= lower(ucast(map_get(input_event, "authentication_method"), "string", null))
|
||||
|
||||
| where signature_id = "4624" AND
|
||||
(authentication_method="ntlmssp" OR authentication_method="kerberos") AND
|
||||
dest_user_id != null AND
|
||||
origin_device_id != null
|
||||
|
||||
| eval isKerberos=if(authentication_method == "kerberos", 1, 0),
|
||||
isNtlm=if(authentication_method == "ntlmssp", 1, 0),
|
||||
timeNTLM=if(isNtlm > 0, timestamp, null)
|
||||
|
||||
| stats sum(isKerberos) as totalKerberos,
|
||||
sum(isNtlm) as totalNtlm,
|
||||
min(timestamp) as startTime,
|
||||
min(timeNTLM) as startNTLMTime,
|
||||
max(timestamp) as endTime,
|
||||
max(timeNTLM) as endNTLMTime by dest_user_id, dest_user, origin_device_id, span(timestamp, 86400s)
|
||||
|
||||
| where NOT dest_user="-" AND
|
||||
totalKerberos > 0 AND
|
||||
totalNtlm > 0 AND
|
||||
endTime - startTime > 1800000 AND
|
||||
(totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND
|
||||
(endTime - startTime) > 3 * (endNTLMTime - startNTLMTime)
|
||||
|
||||
| eval start_time=startNTLMTime,
|
||||
end_time=endNTLMTime,
|
||||
entities=mvappend(dest_user_id, origin_device_id),
|
||||
body=create_map(["total_kerberos", totalKerberos,
|
||||
"total_ntlm", totalNtlm,
|
||||
"analysis_start_time", startTime,
|
||||
"analysis_end_time", endTime,
|
||||
"detection_start_time", startNTLMTime,
|
||||
"detection_end_time", endNTLMTime])
|
||||
|
||||
| into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest - at least from domain controllers. Please make sure that event ID 4624 is being logged.
|
||||
known_false_positives: Environments in which NTLM is used extremely rarely and for benign purposes (such as a rare use of SMB shares).
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1550/002/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Lateral Movement
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 80
|
||||
impact: 80
|
||||
risk_score: 64
|
||||
risk_severity: high
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
- Stage:Lateral Movement
|
||||
kill_chain_phases:
|
||||
- Lateral Movement
|
||||
message: Potential lateral movement and credential stealing via Pass the Token or Pass the Hash techniques. Operation is
|
||||
performed via credentials of the account $dest_user_id$ and observed by the logging device $origin_device_id$
|
||||
mitre_attack_id:
|
||||
- T1550.002
|
||||
nist:
|
||||
- PR.PT
|
||||
- PR.AT
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Actor
|
||||
- name: origin_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Other
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- signature_id
|
||||
- dest_user
|
||||
- dest_user_id
|
||||
- origin_device_id
|
||||
- authentication_method
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,11 @@
|
||||
name: Potential Pass the Token or Hash Observed at the Destination Device - SSA Unit test
|
||||
tests:
|
||||
- name: Potential Pass the Token or Hash Observed at the Destination Device
|
||||
file: endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test Pass the Hash or Pass the Token Detection Observed by a Destination Device
|
||||
attack_data:
|
||||
- file_name: ptt_pth_kerb_ntlm_anon_dest_dataset.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.002/extracts_from_real_data/ptt_pth_kerb_ntlm_anon_dest_dataset.log
|
||||
source: WinEventLog:Security
|
||||
|
||||
@@ -0,0 +1,11 @@
|
||||
name: Potential Pass the Token or Hash Observed by an Event Collecting Device - SSA Unit test
|
||||
tests:
|
||||
- name: Potential Pass the Token or Hash Observed by an Event Collecting Device
|
||||
file: endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test Pass the Hash or Pass the Token Detection Observed by an Event Collecting Device
|
||||
attack_data:
|
||||
- file_name: ptt_pth_kerb_ntlm_anon_DC_dataset.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.002/extracts_from_real_data/ptt_pth_kerb_ntlm_anon_DC_dataset.log
|
||||
source: WinEventLog:Security
|
||||
|
||||
Reference in New Issue
Block a user