From 444dde5d66343543295dc12b4e1d36abec91f338 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 3 May 2023 11:51:24 -0700 Subject: [PATCH 1/3] Revert "deprecate Pth" --- .../detect_activity_related_to_pass_the_hash_attacks.yml | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename detections/{deprecated => endpoint}/detect_activity_related_to_pass_the_hash_attacks.yml (100%) diff --git a/detections/deprecated/detect_activity_related_to_pass_the_hash_attacks.yml b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml similarity index 100% rename from detections/deprecated/detect_activity_related_to_pass_the_hash_attacks.yml rename to detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml From 63abc37bebd9ef861fe7bbf6a2d8c369b16134e6 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 3 May 2023 11:57:27 -0700 Subject: [PATCH 2/3] deprecated note update --- .../detect_activity_related_to_pass_the_hash_attacks.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) rename detections/{endpoint => deprecated}/detect_activity_related_to_pass_the_hash_attacks.yml (85%) diff --git a/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml b/detections/deprecated/detect_activity_related_to_pass_the_hash_attacks.yml similarity index 85% rename from detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml rename to detections/deprecated/detect_activity_related_to_pass_the_hash_attacks.yml index b1fdf11508..b29f18115a 100644 --- a/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml +++ b/detections/deprecated/detect_activity_related_to_pass_the_hash_attacks.yml @@ -3,10 +3,10 @@ id: f5939373-8054-40ad-8c64-cec478a22a4b version: 6 date: '2020-10-15' author: Bhavin Patel, Patrick Bareiss, Splunk -status: production -type: TTP +status: deprecated +type: Hunting description: This search looks for specific authentication events from the Windows - Security Event logs to detect potential attempts at using the Pass-the-Hash technique. + Security Event logs to detect potential attempts at using the Pass-the-Hash technique. This search is DEPRECATED as it is possible for event code 4624 to generate a high level of noise, as legitimate logon events may also trigger this event code. This can be especially true in environments with high levels of user activity, such as those with many concurrent logons or frequent logon attempts. data_source: - Windows Security 4624 search: '`wineventlog_security` EventCode=4624 (Logon_Type=3 Logon_Process=NtLmSsp WorkstationName=WORKSTATION NOT AccountName="ANONYMOUS LOGON") OR (Logon_Type=9 Logon_Process=seclogo) From 8ef2a731222f40aa9946a73a01980b699350716a Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 3 May 2023 11:58:17 -0700 Subject: [PATCH 3/3] mionr --- .../detect_activity_related_to_pass_the_hash_attacks.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/deprecated/detect_activity_related_to_pass_the_hash_attacks.yml b/detections/deprecated/detect_activity_related_to_pass_the_hash_attacks.yml index b29f18115a..d7e447007a 100644 --- a/detections/deprecated/detect_activity_related_to_pass_the_hash_attacks.yml +++ b/detections/deprecated/detect_activity_related_to_pass_the_hash_attacks.yml @@ -9,7 +9,7 @@ description: This search looks for specific authentication events from the Windo Security Event logs to detect potential attempts at using the Pass-the-Hash technique. This search is DEPRECATED as it is possible for event code 4624 to generate a high level of noise, as legitimate logon events may also trigger this event code. This can be especially true in environments with high levels of user activity, such as those with many concurrent logons or frequent logon attempts. data_source: - Windows Security 4624 -search: '`wineventlog_security` EventCode=4624 (Logon_Type=3 Logon_Process=NtLmSsp WorkstationName=WORKSTATION NOT AccountName="ANONYMOUS LOGON") OR (Logon_Type=9 Logon_Process=seclogo) +search: '`wineventlog_security` EventCode=4624 (Logon_Type=3 Logon_Process=NtLmSsp NOT AccountName="ANONYMOUS LOGON") OR (Logon_Type=9 Logon_Process=seclogo) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by EventCode, Logon_Type, WorkstationName, user, dest | `security_content_ctime(firstTime)`