admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2023-05-03 12:09:45 -07:00
committed by GitHub
parent 8f2303e88a 0c76f0139e
commit 3f15163fbf
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/deprecated/detect_activity_related_to_pass_the_hash_attacks.yml
+4 -4
View File
@@ -3,13 +3,13 @@ id: f5939373-8054-40ad-8c64-cec478a22a4b
version: 6
date: '2020-10-15'
author: Bhavin Patel, Patrick Bareiss, Splunk
status: production
type: TTP
status: deprecated
type: Hunting
description: This search looks for specific authentication events from the Windows
Security Event logs to detect potential attempts at using the Pass-the-Hash technique.
Security Event logs to detect potential attempts at using the Pass-the-Hash technique. This search is DEPRECATED as it is possible for event code 4624 to generate a high level of noise, as legitimate logon events may also trigger this event code. This can be especially true in environments with high levels of user activity, such as those with many concurrent logons or frequent logon attempts.
data_source:
- Windows Security 4624
search: '`wineventlog_security` EventCode=4624 (Logon_Type=3 Logon_Process=NtLmSsp WorkstationName=WORKSTATION NOT AccountName="ANONYMOUS LOGON") OR (Logon_Type=9 Logon_Process=seclogo)
search: '`wineventlog_security` EventCode=4624 (Logon_Type=3 Logon_Process=NtLmSsp NOT AccountName="ANONYMOUS LOGON") OR (Logon_Type=9 Logon_Process=seclogo)
| fillnull
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode, Logon_Type, WorkstationName, user, dest
| `security_content_ctime(firstTime)`