From d04dbf8535394771db2104d2b3a3cc6f13b0140f Mon Sep 17 00:00:00 2001 From: Stanislav Miskovic Date: Fri, 3 Sep 2021 16:12:39 -0700 Subject: [PATCH 1/7] Adding a Pth/PtT detection from a vantage point of domain controllers --- .../ssa___ptt_pth_kerb_ntlm_origin_device.yml | 101 ++++++++++++++++++ ...__ptt_pth_kerb_ntlm_origin_device.test.yml | 11 ++ 2 files changed, 112 insertions(+) create mode 100644 detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml create mode 100644 tests/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.test.yml diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml new file mode 100644 index 0000000000..03cb90ac35 --- /dev/null +++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml @@ -0,0 +1,101 @@ +name: Potential Pass the Token or Hash Observed by an Event Collecting Device +id: 1058ba3e-a698-49bc-a1e5-7cedece4ea87 +version: 1 +date: '2021-09-01' +author: Stanislav Miskovic, Splunk +type: TTP +datamodel: [] +description: This detection identifies potential Pass the Token and Pass the Hash credential exploits. We detect the main observable side effect of these techniques, which is transition from the dominant Kerberos logins to rare NTLM logins for a given user, as reported by an event-collecting device (i.e., a specific domain controller or an endpoint destination). + +search: '| from read_ssa_enriched_events() +| eval timestamp= parse_long(ucast(map_get(input_event, "_time"), "string", null)), + signature_id= lower(ucast(map_get(input_event, signature_id), "string", null)), + dest_user= lower(ucast(map_get(input_event, dest_user), "string", null)), + dest_user_id= lower(ucast(map_get(input_event, dest_user_id), "string", null)), + origin_device_id= lower(ucast(map_get(input_event, origin_device_id), "string", null)), + authentication_method= lower(ucast(map_get(input_event, authentication_method), "string", null)) + +| where signature_id="4624" AND + (authentication_method="NtLmSsp" OR authentication_method="Kerberos") AND + dest_user_id != null AND + origin_device_id != null + +| eval isKerberos=if(authentication_method == "Kerberos", 1, 0), + isNtlm=if(authentication_method == "NtLmSsp", 1, 0), + timeInSec=if(len(tostring(timestamp)) > 10, timestamp/1000, timestamp), + timeNTLM=if(isNtlm > 0, timeInSec, null) + +| stats sum(isKerberos) as totalKerberos, + sum(isNtlm) as totalNtlm, + min(timeInSec) as startTime, + min(timeNTLM) as startNTLMTime, + max(timeInSec) as endTime, + max(timeNTLM) as endNTLMTime by dest_user_id, origin_device_id, span(time_num, 86400s) + +| where NOT dest_user="-" AND + totalKerberos > 0 AND + totalNtlm > 0 AND + endTime - startTime > 1800 AND + (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND + (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime) + +| eval start_time=startNTLMTime, + end_time=endNTLMTime, + entities=mvappend(dest_user_id, origin_device_id), + body=create_map(["total_kerberos", totalKerberos, + "total_ntlm", totalNtlm, + "analysis_start_time", startTime, + "analysis_end_time", endTime, + "pth_start_time", startNTLMTime, + "pth_end_time", endNTLMTime]) +| into write_ssa_detected_events();' +how_to_implement: You must be ingesting Windows Security logs from devices of interest - at least from domain controllers. Please make sure that event ID 4624 is being logged. +known_false_positives: Environments in which NTLM is used extremely rarely and for benign purposes (such as a rare use of SMB shares). +references: +- https://attack.mitre.org/techniques/T1550/002/ +tags: + analytic_story: + - Lateral Movement + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 80 + impact: 80 + risk_score: 64 + risk_severity: high + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + - Stage:Lateral Movement + kill_chain_phases: + - Lateral Movement + message: Potential credential stealing via Pass the Token or Pass the Hash techniques. Operation is + performed via credentials of the account $dest_user_id$ and observed by the logging device $origin_device_id$ + mitre_attack_id: + - T1550.002 + nist: + - PR.PT + - PR.AT + - PR.AC + - PR.IP + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: origin_device_id + type: Hostname + role: + - Other + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - signature_id + - dest_user + - dest_user_id + - origin_device_id + - authentication_method + security_domain: endpoint diff --git a/tests/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.test.yml b/tests/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.test.yml new file mode 100644 index 0000000000..da3a7390b4 --- /dev/null +++ b/tests/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.test.yml @@ -0,0 +1,11 @@ +name: Potential Pass the Token or Hash Observed by an Event Collecting Device - SSA Unit test +tests: + - name: Potential Pass the Token or Hash Observed by an Event Collecting Device + file: endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml + pass_condition: '@count_gt(0)' + description: Test Pass the Hash or Pass the Token Detection Observed by an Event Collecting Device + attack_data: + - file_name: logAllMimikatzModules.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.002/ptt_pth_kerb_ntlm_anon_DC_dataset.log + source: WinEventLog:Security + From 52b2b3ddfdcfcbe7cf0c5f9d63fc01b5c803c0e4 Mon Sep 17 00:00:00 2001 From: Stanislav Miskovic Date: Thu, 9 Sep 2021 20:33:13 -0700 Subject: [PATCH 2/7] Correcting some stuff --- .../ssa___ptt_pth_kerb_ntlm_origin_device.yml | 26 +++++++++---------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml index 03cb90ac35..0747f43e0e 100644 --- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml +++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml @@ -9,33 +9,33 @@ description: This detection identifies potential Pass the Token and Pass the Has search: '| from read_ssa_enriched_events() | eval timestamp= parse_long(ucast(map_get(input_event, "_time"), "string", null)), - signature_id= lower(ucast(map_get(input_event, signature_id), "string", null)), - dest_user= lower(ucast(map_get(input_event, dest_user), "string", null)), - dest_user_id= lower(ucast(map_get(input_event, dest_user_id), "string", null)), - origin_device_id= lower(ucast(map_get(input_event, origin_device_id), "string", null)), - authentication_method= lower(ucast(map_get(input_event, authentication_method), "string", null)) + signature_id= lower(ucast(map_get(input_event, "signature_id"), "string", null)), + dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"), "string", null)), + dest_user_id= lower(ucast(map_get(input_event, "dest_user_id"), "string", null)), + origin_device_id= lower(ucast(map_get(input_event, "origin_device_id"), "string", null)), + authentication_method= lower(ucast(map_get(input_event, "authentication_method"), "string", null)) | where signature_id="4624" AND - (authentication_method="NtLmSsp" OR authentication_method="Kerberos") AND + (authentication_method="ntlmssp" OR authentication_method="kerberos") AND dest_user_id != null AND origin_device_id != null -| eval isKerberos=if(authentication_method == "Kerberos", 1, 0), - isNtlm=if(authentication_method == "NtLmSsp", 1, 0), +| eval isKerberos=if(authentication_method == "kerberos", 1, 0), + isNtlm=if(authentication_method == "ntlmssp", 1, 0), timeInSec=if(len(tostring(timestamp)) > 10, timestamp/1000, timestamp), - timeNTLM=if(isNtlm > 0, timeInSec, null) + timeNTLM=if(isNtlm > 0, timestamp, null) | stats sum(isKerberos) as totalKerberos, sum(isNtlm) as totalNtlm, - min(timeInSec) as startTime, + min(timestamp) as startTime, min(timeNTLM) as startNTLMTime, - max(timeInSec) as endTime, - max(timeNTLM) as endNTLMTime by dest_user_id, origin_device_id, span(time_num, 86400s) + max(timestamp) as endTime, + max(timeNTLM) as endNTLMTime by dest_user_id, dest_user, origin_device_id, span(timestamp, 86400s) | where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND - endTime - startTime > 1800 AND + endTime - startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime) From 05820da35d038f1902d2ffbb14359d10a51bb4dc Mon Sep 17 00:00:00 2001 From: Stanislav Miskovic Date: Wed, 15 Sep 2021 16:11:02 -0700 Subject: [PATCH 3/7] Adding SLP confirmed in DSP --- .../ssa___ptt_pth_kerb_ntlm_origin_device.yml | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml index 0747f43e0e..0a159d2cf1 100644 --- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml +++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml @@ -5,24 +5,21 @@ date: '2021-09-01' author: Stanislav Miskovic, Splunk type: TTP datamodel: [] -description: This detection identifies potential Pass the Token and Pass the Hash credential exploits. We detect the main observable side effect of these techniques, which is transition from the dominant Kerberos logins to rare NTLM logins for a given user, as reported by an event-collecting device (i.e., a specific domain controller or an endpoint destination). +description: This detection identifies potential Pass the Token and Pass the Hash credential exploits. We detect main side effect of these attacks, which is transition from the dominant Kerberos logins to rare NTLM logins for a given user, as reported by an event-collecting device (i.e., a specific domain controller or an endpoint destination). search: '| from read_ssa_enriched_events() | eval timestamp= parse_long(ucast(map_get(input_event, "_time"), "string", null)), - signature_id= lower(ucast(map_get(input_event, "signature_id"), "string", null)), dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"), "string", null)), dest_user_id= lower(ucast(map_get(input_event, "dest_user_id"), "string", null)), origin_device_id= lower(ucast(map_get(input_event, "origin_device_id"), "string", null)), authentication_method= lower(ucast(map_get(input_event, "authentication_method"), "string", null)) -| where signature_id="4624" AND - (authentication_method="ntlmssp" OR authentication_method="kerberos") AND +| where (authentication_method="ntlmssp" OR authentication_method="kerberos") AND dest_user_id != null AND origin_device_id != null | eval isKerberos=if(authentication_method == "kerberos", 1, 0), isNtlm=if(authentication_method == "ntlmssp", 1, 0), - timeInSec=if(len(tostring(timestamp)) > 10, timestamp/1000, timestamp), timeNTLM=if(isNtlm > 0, timestamp, null) | stats sum(isKerberos) as totalKerberos, @@ -35,8 +32,8 @@ search: '| from read_ssa_enriched_events() | where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND - endTime - startTime > 1800000 AND - (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND + endTime - startTime > 1800 AND + (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime) | eval start_time=startNTLMTime, @@ -46,8 +43,9 @@ search: '| from read_ssa_enriched_events() "total_ntlm", totalNtlm, "analysis_start_time", startTime, "analysis_end_time", endTime, - "pth_start_time", startNTLMTime, - "pth_end_time", endNTLMTime]) + "detection_start_time", startNTLMTime, + "detection_end_time", endNTLMTime]) + | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest - at least from domain controllers. Please make sure that event ID 4624 is being logged. known_false_positives: Environments in which NTLM is used extremely rarely and for benign purposes (such as a rare use of SMB shares). From 784d9406311f8593c4c89c433671f4e65fb58e64 Mon Sep 17 00:00:00 2001 From: Stanislav Miskovic Date: Thu, 16 Sep 2021 20:44:41 -0700 Subject: [PATCH 4/7] Returning signature_id into the detection --- detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml index 0a159d2cf1..ad1de7996b 100644 --- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml +++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml @@ -12,9 +12,11 @@ search: '| from read_ssa_enriched_events() dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"), "string", null)), dest_user_id= lower(ucast(map_get(input_event, "dest_user_id"), "string", null)), origin_device_id= lower(ucast(map_get(input_event, "origin_device_id"), "string", null)), + signature_id= lower(ucast(map_get(input_event, "signature_id"), "string", null)), authentication_method= lower(ucast(map_get(input_event, "authentication_method"), "string", null)) -| where (authentication_method="ntlmssp" OR authentication_method="kerberos") AND +| where signature_id = "4624" AND + (authentication_method="ntlmssp" OR authentication_method="kerberos") AND dest_user_id != null AND origin_device_id != null From e5a7afa9a3679a4934ec1d810792d510abe3bf38 Mon Sep 17 00:00:00 2001 From: Stanislav Miskovic Date: Thu, 16 Sep 2021 22:15:58 -0700 Subject: [PATCH 5/7] Adding Pth and PtT detections at logging devices and endpoints, tested on DSP --- .../ssa___ptt_pth_kerb_ntlm_dest_device.yml | 101 ++++++++++++++++++ .../ssa___ptt_pth_kerb_ntlm_origin_device.yml | 4 +- ...a___ptt_pth_kerb_ntlm_dest_device.test.yml | 11 ++ ...__ptt_pth_kerb_ntlm_origin_device.test.yml | 2 +- 4 files changed, 115 insertions(+), 3 deletions(-) create mode 100644 detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml create mode 100644 tests/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.test.yml diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml new file mode 100644 index 0000000000..498a118148 --- /dev/null +++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml @@ -0,0 +1,101 @@ +name: Potential Pass the Token or Hash Observed at the Destination Device +id: 82e76b80-5cdb-4899-9b43-85dbe777b36d +version: 1 +date: '2021-09-01' +author: Stanislav Miskovic, Splunk +type: TTP +datamodel: [] +description: This detection identifies potential Pass the Token or Pass the Hash credential exploits. We detect the main side effect of these attacks, which is a transition from the dominant Kerberos logins to rare NTLM logins for a given user, as reported by a detination device. + +search: '| from read_ssa_enriched_events() +| eval timestamp= parse_long(ucast(map_get(input_event, "_time"), "string", null)), + dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"), "string", null)), + dest_user_id= lower(ucast(map_get(input_event, "dest_user_id"), "string", null)), + dest_device_id= lower(ucast(map_get(input_event, "dest_device_id"), "string", null)), + signature_id= lower(ucast(map_get(input_event, "signature_id"), "string", null)), + authentication_method= lower(ucast(map_get(input_event, "authentication_method"), "string", null)) + +| where signature_id = "4624" AND + (authentication_method="ntlmssp" OR authentication_method="kerberos") AND + dest_user_id != null AND + dest_device_id != null + +| eval isKerberos=if(authentication_method == "kerberos", 1, 0), + isNtlm=if(authentication_method == "ntlmssp", 1, 0), + timeNTLM=if(isNtlm > 0, timestamp, null) + +| stats sum(isKerberos) as totalKerberos, + sum(isNtlm) as totalNtlm, + min(timestamp) as startTime, + min(timeNTLM) as startNTLMTime, + max(timestamp) as endTime, + max(timeNTLM) as endNTLMTime by dest_user_id, dest_user, dest_device_id, span(timestamp, 86400s) + +| where NOT dest_user="-" AND + totalKerberos > 0 AND + totalNtlm > 0 AND + endTime - startTime > 1800 AND + (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND + (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime) + +| eval start_time=ucast(startNTLMTime, "long", null), + end_time=ucast(endNTLMTime, "long", null), + entities=mvappend(dest_user_id, dest_device_id), + body=create_map(["total_kerberos", totalKerberos, + "total_ntlm", totalNtlm, + "analysis_start_time", startTime, + "analysis_end_time", endTime, + "pth_start_time", startNTLMTime, + "pth_end_time", endNTLMTime]) + +| into write_ssa_detected_events();' +how_to_implement: You must be ingesting Windows Security logs from endpoint devices, i.e., destinations of interest. Please make sure that event ID 4624 is being logged. +known_false_positives: Environments in which NTLM is used extremely rarely and for benign purposes (such as a rare use of SMB shares). +references: +- https://attack.mitre.org/techniques/T1550/002/ +tags: + analytic_story: + - Lateral Movement + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 90 + impact: 80 + risk_score: 72 + risk_severity: high + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + - Stage:Lateral Movement + kill_chain_phases: + - Lateral Movement + message: Potential lateral movement and credential stealing via Pass the Token or Pass the Hash techniques. Operation is + performed via credentials of the account $dest_user_id$ and observed by the destination device $dest_device_id$ + mitre_attack_id: + - T1550.002 + nist: + - PR.PT + - PR.AT + - PR.AC + - PR.IP + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Other + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - signature_id + - dest_user + - dest_user_id + - dest_device_id + - authentication_method + security_domain: endpoint diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml index ad1de7996b..6eb3ede56e 100644 --- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml +++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml @@ -5,7 +5,7 @@ date: '2021-09-01' author: Stanislav Miskovic, Splunk type: TTP datamodel: [] -description: This detection identifies potential Pass the Token and Pass the Hash credential exploits. We detect main side effect of these attacks, which is transition from the dominant Kerberos logins to rare NTLM logins for a given user, as reported by an event-collecting device (i.e., a specific domain controller or an endpoint destination). +description: This detection identifies potential Pass the Token or Pass the Hash credential exploits. We detect the main side effect of these attacks, which is a transition from the dominant Kerberos logins to rare NTLM logins for a given user, as reported by an event-collecting device (i.e., a specific domain controller or an endpoint destination). search: '| from read_ssa_enriched_events() | eval timestamp= parse_long(ucast(map_get(input_event, "_time"), "string", null)), @@ -71,7 +71,7 @@ tags: - Stage:Lateral Movement kill_chain_phases: - Lateral Movement - message: Potential credential stealing via Pass the Token or Pass the Hash techniques. Operation is + message: Potential lateral movement and credential stealing via Pass the Token or Pass the Hash techniques. Operation is performed via credentials of the account $dest_user_id$ and observed by the logging device $origin_device_id$ mitre_attack_id: - T1550.002 diff --git a/tests/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.test.yml b/tests/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.test.yml new file mode 100644 index 0000000000..17f6b96274 --- /dev/null +++ b/tests/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.test.yml @@ -0,0 +1,11 @@ +name: Potential Pass the Token or Hash Observed at the Destination Device - SSA Unit test +tests: + - name: Potential Pass the Token or Hash Observed at the Destination Device + file: endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml + pass_condition: '@count_gt(0)' + description: Test Pass the Hash or Pass the Token Detection Observed by a Destination Device + attack_data: + - file_name: ptt_pth_kerb_ntlm_anon_dest_dataset.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.002/ptt_pth_kerb_ntlm_anon_dest_dataset.log + source: WinEventLog:Security + diff --git a/tests/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.test.yml b/tests/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.test.yml index da3a7390b4..4b2686b745 100644 --- a/tests/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.test.yml +++ b/tests/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.test.yml @@ -5,7 +5,7 @@ tests: pass_condition: '@count_gt(0)' description: Test Pass the Hash or Pass the Token Detection Observed by an Event Collecting Device attack_data: - - file_name: logAllMimikatzModules.log + - file_name: ptt_pth_kerb_ntlm_anon_DC_dataset.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.002/ptt_pth_kerb_ntlm_anon_DC_dataset.log source: WinEventLog:Security From 75109143cac016a13e47a01ed9ab3a5c802946ca Mon Sep 17 00:00:00 2001 From: Stanislav Miskovic Date: Mon, 20 Sep 2021 10:20:33 -0700 Subject: [PATCH 6/7] Paths to new tests ... --- tests/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.test.yml | 2 +- tests/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.test.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.test.yml b/tests/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.test.yml index 17f6b96274..9b4d5fe5ef 100644 --- a/tests/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.test.yml +++ b/tests/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.test.yml @@ -6,6 +6,6 @@ tests: description: Test Pass the Hash or Pass the Token Detection Observed by a Destination Device attack_data: - file_name: ptt_pth_kerb_ntlm_anon_dest_dataset.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.002/ptt_pth_kerb_ntlm_anon_dest_dataset.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.002/extracts_from_real_data/ptt_pth_kerb_ntlm_anon_dest_dataset.log source: WinEventLog:Security diff --git a/tests/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.test.yml b/tests/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.test.yml index 4b2686b745..1e25836ab5 100644 --- a/tests/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.test.yml +++ b/tests/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.test.yml @@ -6,6 +6,6 @@ tests: description: Test Pass the Hash or Pass the Token Detection Observed by an Event Collecting Device attack_data: - file_name: ptt_pth_kerb_ntlm_anon_DC_dataset.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.002/ptt_pth_kerb_ntlm_anon_DC_dataset.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.002/extracts_from_real_data/ptt_pth_kerb_ntlm_anon_DC_dataset.log source: WinEventLog:Security From 9cc5d2a177bd8bb1de4f3333f91234565efa9d13 Mon Sep 17 00:00:00 2001 From: Stanislav Miskovic Date: Fri, 24 Sep 2021 11:19:38 -0700 Subject: [PATCH 7/7] Fixing a problem with time being in milliseconds vs seconds - setting observation confirence interval back to 30 min --- detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml | 2 +- detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml index 498a118148..223ace1b18 100644 --- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml +++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml @@ -34,7 +34,7 @@ search: '| from read_ssa_enriched_events() | where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND - endTime - startTime > 1800 AND + endTime - startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime) diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml index 6eb3ede56e..7e06ecfb9d 100644 --- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml +++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml @@ -34,7 +34,7 @@ search: '| from read_ssa_enriched_events() | where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND - endTime - startTime > 1800 AND + endTime - startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime)