From 97992ce077b8aa74535cd82fb82ae219e12d00c0 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 11 Apr 2023 08:54:40 -0700 Subject: [PATCH] Update detect_activity_related_to_pass_the_hash_attacks.yml --- ...etect_activity_related_to_pass_the_hash_attacks.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml index c89705905e..b1fdf11508 100644 --- a/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml +++ b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml @@ -9,10 +9,12 @@ description: This search looks for specific authentication events from the Windo Security Event logs to detect potential attempts at using the Pass-the-Hash technique. data_source: - Windows Security 4624 -search: '`wineventlog_security` EventCode=4624 (Logon_Type=3 Logon_Process=NtLmSsp NOT AccountName="ANONYMOUS LOGON") OR (Logon_Type=9 - Logon_Process=seclogo) | fillnull | stats count min(_time) as firstTime max(_time) - as lastTime by EventCode, Logon_Type, WorkstationName, user, dest | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)` | `detect_activity_related_to_pass_the_hash_attacks_filter` ' +search: '`wineventlog_security` EventCode=4624 (Logon_Type=3 Logon_Process=NtLmSsp WorkstationName=WORKSTATION NOT AccountName="ANONYMOUS LOGON") OR (Logon_Type=9 Logon_Process=seclogo) +| fillnull +| stats count min(_time) as firstTime max(_time) as lastTime by EventCode, Logon_Type, WorkstationName, user, dest +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `detect_activity_related_to_pass_the_hash_attacks_filter`' how_to_implement: To successfully implement this search, you must ingest your Windows Security Event logs and leverage the latest TA for Windows. known_false_positives: Legitimate logon activity by authorized NTLM systems may be