admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'password_spraying_TR-515' of https://github.com/splunk/security_content into password_spraying_TR-515

Browse Source
This commit is contained in:
Detection Testing Service
2021-05-06 15:27:11 +00:00
parent c56f9ff15c 374b1a9971
commit 5895efc4bf
1 changed files with 32 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml
+32 -21
View File
@@ -6,28 +6,36 @@ author: Mauricio Velazco, Splunk
type: batch
datamodel:
- Endpoint
description: 'The following analytic identifies one source endpoint failing to authenticate with multiple disabled domain users using the Kerberos protocol.
This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain
initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. I certain scenarios, adversaries may execute a password spraying attack against disabled users.
In this logic, the number of unique users is hardcoded to 10 but can or should be customized to fit especific environments.
Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code 0x12 means
`clients credentials have been revoked` (account disabled, expired or locked out).\
This detection will trigger on the domain controller against which the offending host performs the password spraying attack.\
The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.'
search: '`wineventlog_security` EventCode=4768 Account_Name!="*$" Result_Code=0x12
| bucket span=2m _time
| stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address
| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Client_Address
| eval upperBound=(comp_avg+comp_std*3)
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
| search isOutlier=1
| `multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos_filter` '
how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
known_false_positives: A host failing to authenticate with multiple disabled domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems.
description: 'The following analytic identifies one source endpoint failing to authenticate
with multiple disabled domain users using the Kerberos protocol. This behavior could
represent an adversary performing a Password Spraying attack against an Active Directory
environment using Kerberos to obtain initial access or elevate privileges. As attackers
progress in a breach, mistakes will be made. I certain scenarios, adversaries may
execute a password spraying attack against disabled users. In this logic, the number
of unique users is hardcoded to 10 but can or should be customized to fit especific
environments. Event 4768 is generated every time the Key Distribution Center issues
a Kerberos Ticket Granting Ticket (TGT). Failure code 0x12 means `clients credentials
have been revoked` (account disabled, expired or locked out).\
This detection will trigger on the domain controller against which the offending
host performs the password spraying attack.\
The analytics returned fields allow analysts to investigate the event further by
providing fields like source ip and attempted user accounts.'
search: '`wineventlog_security` EventCode=4768 Account_Name!="*$" Result_Code=0x12
| bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name)
as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as
comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3)
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
| search isOutlier=1 | `multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos_filter` '
how_to_implement: To successfully implement this search, you need to be ingesting
Domain Controller and Kerberos events. The Advanced Security Audit policy setting
`Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
known_false_positives: A host failing to authenticate with multiple disabled domain
users is not a common behavior for legitimate systems. Possible false positive scenarios
include but are not limited to vulnerability scanners and missconfigured systems.
references:
- https://attack.mitre.org/techniques/T1110/003/
- https://attack.mitre.org/techniques/T1110/003/
tags:
analytic_story:
- Active Directory Password Spraying
@@ -46,3 +54,6 @@ tags:
- Account_Name
- Client_Address
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos/windows-security.log