admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update detect_activity_related_to_pass_the_hash_attacks.yml

Browse Source
This commit is contained in:
Bhavin Patel
2023-04-11 08:54:40 -07:00
committed by GitHub
parent 080e429c01
commit 97992ce077
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml
+6 -4
View File
@@ -9,10 +9,12 @@ description: This search looks for specific authentication events from the Windo
Security Event logs to detect potential attempts at using the Pass-the-Hash technique.
data_source:
- Windows Security 4624
search: '`wineventlog_security` EventCode=4624 (Logon_Type=3 Logon_Process=NtLmSsp NOT AccountName="ANONYMOUS LOGON") OR (Logon_Type=9
Logon_Process=seclogo) | fillnull | stats count min(_time) as firstTime max(_time)
as lastTime by EventCode, Logon_Type, WorkstationName, user, dest | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)` | `detect_activity_related_to_pass_the_hash_attacks_filter` '
search: '`wineventlog_security` EventCode=4624 (Logon_Type=3 Logon_Process=NtLmSsp WorkstationName=WORKSTATION NOT AccountName="ANONYMOUS LOGON") OR (Logon_Type=9 Logon_Process=seclogo)
| fillnull
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode, Logon_Type, WorkstationName, user, dest
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `detect_activity_related_to_pass_the_hash_attacks_filter`'
how_to_implement: To successfully implement this search, you must ingest your Windows
Security Event logs and leverage the latest TA for Windows.
known_false_positives: Legitimate logon activity by authorized NTLM systems may be