admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update active_directory_password_spraying.yml

Browse Source 
description update
This commit is contained in:
mvelazco
2021-04-16 10:48:18 -04:00
parent c84656c87b
commit 4cb46fcd21
1 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stories/active_directory_password_spraying.yml
+8 -3
View File
@@ -4,19 +4,24 @@ version: 1
date: '2021-04-07'
author: Mauricio Velazco, Splunk
type: batch
description: Monitor for activities and techniques associated with Password Spraying attacks against Active Directory environments.
description: Monitor for activities and techniques associated with Password Spraying attacks within Active Directory environments.
narrative: Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials.
Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain.
Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing
a single account with many passwords. This technique allows an adversary to remain undetected. \
Password Spraying can be leverages by adversaries to obtain initial access in a network or to escalate privileges in an environment where access has been already obtained.
Password Spraying can be leveraged by adversaries to obtain initial access in a network or to escalate privileges in an environment where access has been already obtained.
This Analytic Story is focused on detecting potential Password Spraying attacks against Active Directory environments. It presents
This Analytic Story is focused on detecting potential Password Spraying attacks against Active Directory environments leveraging Windows Event Logs in the
'Account Logon' and 'Logon/Logoff' Advanced Audit Policy categories. It presents 9 different detection analytics which aid defenders in identifyng instances where one source
user, source host or source process fails to authenticate against a target or targets using multiple users. A user, host or process failing to authenticate with multiple
users is not a common behavior for legitimate systems and should be monitored by blue teams. Possible false positive scenarios include but are not limited to
vulnerability scanners, remote administration tools and missconfigured systems. These can be quickly spotted and addded to an allow list.
references:
- https://attack.mitre.org/techniques/T1110/003/
- https://www.hub.trimarcsecurity.com/post/trimarc-research-detecting-password-spraying-with-security-event-auditing
- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-password-spraying
- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn452415(v=ws.11)
tags:
analytic_story:
- Active Directory Password Spraying