diff --git a/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml b/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml index 0f930c9c34..e42b874688 100644 --- a/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml +++ b/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml @@ -6,35 +6,43 @@ author: Mauricio Velazco, Splunk type: batch datamodel: - Endpoint -description: 'The following analytic identifies a source user failing to authenticate with multiple users using explicit credentials on a host. - This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. - In this logic, the number of unique users is hardcoded to `10` but can/should be customized to fit especific environments. - Event 4648 is generated when a process attempts an account logon by explicitly specifying that account`s credentials. This event generates on domain controllers, member servers, and workstations.\ +description: 'The following analytic identifies a source user failing to authenticate + with multiple users using explicit credentials on a host. This behavior could represent + an adversary performing a Password Spraying attack against an Active Directory environment + to obtain initial access or elevate privileges. In this logic, the number of unique + users is hardcoded to `10` but can/should be customized to fit especific environments. + Event 4648 is generated when a process attempts an account logon by explicitly specifying + that account`s credentials. This event generates on domain controllers, member servers, + and workstations.\ - This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed.\ + This detection will trigger on the potenfially malicious host, perhaps controlled + via a trojan or operated by an insider threat, from where a password spraying attack + is being executed.\ - The analytic`s returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified.' - -search: ' `wineventlog_security` EventCode=4648 - | bucket span=2m _time - | eval Source_Account = mvindex(Account_Name, 0) - | eval Destination_Account = mvindex(Account_Name, 1) - | search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$" - | stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_account by _time, ComputerName, Source_Account - | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by ComputerName - | eval upperBound=(comp_avg+comp_std*3) - | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 - | `multiple_users_attempting_to_authenticate_using_explicit_credentials_filter` ' -how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as - well as member servers and workstations. The Advanced Security Audit policy setting 'Audit Logon' within 'Logon/Logoff' needs to be enabled. -known_false_positives: A source user failing attempting to authenticate multiple users on a host is not a common behavior for regular systems. - Some applications, however, may exhibit this behavior in which case sets of users hosts can be added to an allow list. - Possible false positive scenarios include systems where several users connect to like Mail servers, identity providers, remote desktop services, Citrix, etc. + The analytic`s returned fields allow analysts to investigate the event further by + providing fields like source account, attempted user accounts and the endpoint were + the behavior was identified.' +search: ' `wineventlog_security` EventCode=4648 | bucket span=2m _time | eval Source_Account + = mvindex(Account_Name, 0) | eval Destination_Account = mvindex(Account_Name, 1) + | search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$" + | stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as + tried_account by _time, ComputerName, Source_Account | eventstats avg(unique_accounts) + as comp_avg , stdev(unique_accounts) as comp_std by ComputerName | eval upperBound=(comp_avg+comp_std*3) + | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) + | search isOutlier=1 | `multiple_users_attempting_to_authenticate_using_explicit_credentials_filter` ' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Event Logs from domain controllers as well as member servers and workstations. + The Advanced Security Audit policy setting 'Audit Logon' within 'Logon/Logoff' needs + to be enabled. +known_false_positives: A source user failing attempting to authenticate multiple users + on a host is not a common behavior for regular systems. Some applications, however, + may exhibit this behavior in which case sets of users hosts can be added to an allow + list. Possible false positive scenarios include systems where several users connect + to like Mail servers, identity providers, remote desktop services, Citrix, etc. references: - - https://attack.mitre.org/techniques/T1110/003/ - - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648 - - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events +- https://attack.mitre.org/techniques/T1110/003/ +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648 +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events tags: analytic_story: - Active Directory Password Spraying @@ -52,4 +60,7 @@ tags: - Security_ID - Account_Name - ComputerName - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray/windows-security.log