admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'password_spraying_TR-515' of https://github.com/splunk/security_content into password_spraying_TR-515

Browse Source
This commit is contained in:
Detection Testing Service
2021-05-06 19:31:04 +00:00
parent 12098328a9 4f57581faa
commit 5abc7dffd3
1 changed files with 38 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml
+38 -27
View File
@@ -6,35 +6,43 @@ author: Mauricio Velazco, Splunk
type: batch
datamodel:
- Endpoint
description: 'The following analytic identifies a source user failing to authenticate with multiple users using explicit credentials on a host.
This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges.
In this logic, the number of unique users is hardcoded to `10` but can/should be customized to fit especific environments.
Event 4648 is generated when a process attempts an account logon by explicitly specifying that account`s credentials. This event generates on domain controllers, member servers, and workstations.\
description: 'The following analytic identifies a source user failing to authenticate
with multiple users using explicit credentials on a host. This behavior could represent
an adversary performing a Password Spraying attack against an Active Directory environment
to obtain initial access or elevate privileges. In this logic, the number of unique
users is hardcoded to `10` but can/should be customized to fit especific environments.
Event 4648 is generated when a process attempts an account logon by explicitly specifying
that account`s credentials. This event generates on domain controllers, member servers,
and workstations.\
This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed.\
This detection will trigger on the potenfially malicious host, perhaps controlled
via a trojan or operated by an insider threat, from where a password spraying attack
is being executed.\
The analytic`s returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified.'
search: ' `wineventlog_security` EventCode=4648
| bucket span=2m _time
| eval Source_Account = mvindex(Account_Name, 0)
| eval Destination_Account = mvindex(Account_Name, 1)
| search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$"
| stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_account by _time, ComputerName, Source_Account
| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by ComputerName
| eval upperBound=(comp_avg+comp_std*3)
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
| search isOutlier=1
| `multiple_users_attempting_to_authenticate_using_explicit_credentials_filter` '
how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as
well as member servers and workstations. The Advanced Security Audit policy setting 'Audit Logon' within 'Logon/Logoff' needs to be enabled.
known_false_positives: A source user failing attempting to authenticate multiple users on a host is not a common behavior for regular systems.
Some applications, however, may exhibit this behavior in which case sets of users hosts can be added to an allow list.
Possible false positive scenarios include systems where several users connect to like Mail servers, identity providers, remote desktop services, Citrix, etc.
The analytic`s returned fields allow analysts to investigate the event further by
providing fields like source account, attempted user accounts and the endpoint were
the behavior was identified.'
search: ' `wineventlog_security` EventCode=4648 | bucket span=2m _time | eval Source_Account
= mvindex(Account_Name, 0) | eval Destination_Account = mvindex(Account_Name, 1)
| search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$"
| stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as
tried_account by _time, ComputerName, Source_Account | eventstats avg(unique_accounts)
as comp_avg , stdev(unique_accounts) as comp_std by ComputerName | eval upperBound=(comp_avg+comp_std*3)
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
| search isOutlier=1 | `multiple_users_attempting_to_authenticate_using_explicit_credentials_filter` '
how_to_implement: To successfully implement this search, you need to be ingesting
Windows Event Logs from domain controllers as well as member servers and workstations.
The Advanced Security Audit policy setting 'Audit Logon' within 'Logon/Logoff' needs
to be enabled.
known_false_positives: A source user failing attempting to authenticate multiple users
on a host is not a common behavior for regular systems. Some applications, however,
may exhibit this behavior in which case sets of users hosts can be added to an allow
list. Possible false positive scenarios include systems where several users connect
to like Mail servers, identity providers, remote desktop services, Citrix, etc.
references:
- https://attack.mitre.org/techniques/T1110/003/
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events
- https://attack.mitre.org/techniques/T1110/003/
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events
tags:
analytic_story:
- Active Directory Password Spraying
@@ -52,4 +60,7 @@ tags:
- Security_ID
- Account_Name
- ComputerName
security_domain: endpoint
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray/windows-security.log