diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml new file mode 100644 index 0000000000..223ace1b18 --- /dev/null +++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml @@ -0,0 +1,101 @@ +name: Potential Pass the Token or Hash Observed at the Destination Device +id: 82e76b80-5cdb-4899-9b43-85dbe777b36d +version: 1 +date: '2021-09-01' +author: Stanislav Miskovic, Splunk +type: TTP +datamodel: [] +description: This detection identifies potential Pass the Token or Pass the Hash credential exploits. We detect the main side effect of these attacks, which is a transition from the dominant Kerberos logins to rare NTLM logins for a given user, as reported by a detination device. + +search: '| from read_ssa_enriched_events() +| eval timestamp= parse_long(ucast(map_get(input_event, "_time"), "string", null)), + dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"), "string", null)), + dest_user_id= lower(ucast(map_get(input_event, "dest_user_id"), "string", null)), + dest_device_id= lower(ucast(map_get(input_event, "dest_device_id"), "string", null)), + signature_id= lower(ucast(map_get(input_event, "signature_id"), "string", null)), + authentication_method= lower(ucast(map_get(input_event, "authentication_method"), "string", null)) + +| where signature_id = "4624" AND + (authentication_method="ntlmssp" OR authentication_method="kerberos") AND + dest_user_id != null AND + dest_device_id != null + +| eval isKerberos=if(authentication_method == "kerberos", 1, 0), + isNtlm=if(authentication_method == "ntlmssp", 1, 0), + timeNTLM=if(isNtlm > 0, timestamp, null) + +| stats sum(isKerberos) as totalKerberos, + sum(isNtlm) as totalNtlm, + min(timestamp) as startTime, + min(timeNTLM) as startNTLMTime, + max(timestamp) as endTime, + max(timeNTLM) as endNTLMTime by dest_user_id, dest_user, dest_device_id, span(timestamp, 86400s) + +| where NOT dest_user="-" AND + totalKerberos > 0 AND + totalNtlm > 0 AND + endTime - startTime > 1800000 AND + (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND + (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime) + +| eval start_time=ucast(startNTLMTime, "long", null), + end_time=ucast(endNTLMTime, "long", null), + entities=mvappend(dest_user_id, dest_device_id), + body=create_map(["total_kerberos", totalKerberos, + "total_ntlm", totalNtlm, + "analysis_start_time", startTime, + "analysis_end_time", endTime, + "pth_start_time", startNTLMTime, + "pth_end_time", endNTLMTime]) + +| into write_ssa_detected_events();' +how_to_implement: You must be ingesting Windows Security logs from endpoint devices, i.e., destinations of interest. Please make sure that event ID 4624 is being logged. +known_false_positives: Environments in which NTLM is used extremely rarely and for benign purposes (such as a rare use of SMB shares). +references: +- https://attack.mitre.org/techniques/T1550/002/ +tags: + analytic_story: + - Lateral Movement + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 90 + impact: 80 + risk_score: 72 + risk_severity: high + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + - Stage:Lateral Movement + kill_chain_phases: + - Lateral Movement + message: Potential lateral movement and credential stealing via Pass the Token or Pass the Hash techniques. Operation is + performed via credentials of the account $dest_user_id$ and observed by the destination device $dest_device_id$ + mitre_attack_id: + - T1550.002 + nist: + - PR.PT + - PR.AT + - PR.AC + - PR.IP + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Other + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - signature_id + - dest_user + - dest_user_id + - dest_device_id + - authentication_method + security_domain: endpoint diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml new file mode 100644 index 0000000000..7e06ecfb9d --- /dev/null +++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml @@ -0,0 +1,101 @@ +name: Potential Pass the Token or Hash Observed by an Event Collecting Device +id: 1058ba3e-a698-49bc-a1e5-7cedece4ea87 +version: 1 +date: '2021-09-01' +author: Stanislav Miskovic, Splunk +type: TTP +datamodel: [] +description: This detection identifies potential Pass the Token or Pass the Hash credential exploits. We detect the main side effect of these attacks, which is a transition from the dominant Kerberos logins to rare NTLM logins for a given user, as reported by an event-collecting device (i.e., a specific domain controller or an endpoint destination). + +search: '| from read_ssa_enriched_events() +| eval timestamp= parse_long(ucast(map_get(input_event, "_time"), "string", null)), + dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"), "string", null)), + dest_user_id= lower(ucast(map_get(input_event, "dest_user_id"), "string", null)), + origin_device_id= lower(ucast(map_get(input_event, "origin_device_id"), "string", null)), + signature_id= lower(ucast(map_get(input_event, "signature_id"), "string", null)), + authentication_method= lower(ucast(map_get(input_event, "authentication_method"), "string", null)) + +| where signature_id = "4624" AND + (authentication_method="ntlmssp" OR authentication_method="kerberos") AND + dest_user_id != null AND + origin_device_id != null + +| eval isKerberos=if(authentication_method == "kerberos", 1, 0), + isNtlm=if(authentication_method == "ntlmssp", 1, 0), + timeNTLM=if(isNtlm > 0, timestamp, null) + +| stats sum(isKerberos) as totalKerberos, + sum(isNtlm) as totalNtlm, + min(timestamp) as startTime, + min(timeNTLM) as startNTLMTime, + max(timestamp) as endTime, + max(timeNTLM) as endNTLMTime by dest_user_id, dest_user, origin_device_id, span(timestamp, 86400s) + +| where NOT dest_user="-" AND + totalKerberos > 0 AND + totalNtlm > 0 AND + endTime - startTime > 1800000 AND + (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND + (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime) + +| eval start_time=startNTLMTime, + end_time=endNTLMTime, + entities=mvappend(dest_user_id, origin_device_id), + body=create_map(["total_kerberos", totalKerberos, + "total_ntlm", totalNtlm, + "analysis_start_time", startTime, + "analysis_end_time", endTime, + "detection_start_time", startNTLMTime, + "detection_end_time", endNTLMTime]) + +| into write_ssa_detected_events();' +how_to_implement: You must be ingesting Windows Security logs from devices of interest - at least from domain controllers. Please make sure that event ID 4624 is being logged. +known_false_positives: Environments in which NTLM is used extremely rarely and for benign purposes (such as a rare use of SMB shares). +references: +- https://attack.mitre.org/techniques/T1550/002/ +tags: + analytic_story: + - Lateral Movement + asset_type: Windows + cis20: + - CIS 16 + - CIS 20 + confidence: 80 + impact: 80 + risk_score: 64 + risk_severity: high + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + - Stage:Lateral Movement + kill_chain_phases: + - Lateral Movement + message: Potential lateral movement and credential stealing via Pass the Token or Pass the Hash techniques. Operation is + performed via credentials of the account $dest_user_id$ and observed by the logging device $origin_device_id$ + mitre_attack_id: + - T1550.002 + nist: + - PR.PT + - PR.AT + - PR.AC + - PR.IP + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: origin_device_id + type: Hostname + role: + - Other + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - signature_id + - dest_user + - dest_user_id + - origin_device_id + - authentication_method + security_domain: endpoint diff --git a/tests/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.test.yml b/tests/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.test.yml new file mode 100644 index 0000000000..9b4d5fe5ef --- /dev/null +++ b/tests/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.test.yml @@ -0,0 +1,11 @@ +name: Potential Pass the Token or Hash Observed at the Destination Device - SSA Unit test +tests: + - name: Potential Pass the Token or Hash Observed at the Destination Device + file: endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml + pass_condition: '@count_gt(0)' + description: Test Pass the Hash or Pass the Token Detection Observed by a Destination Device + attack_data: + - file_name: ptt_pth_kerb_ntlm_anon_dest_dataset.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.002/extracts_from_real_data/ptt_pth_kerb_ntlm_anon_dest_dataset.log + source: WinEventLog:Security + diff --git a/tests/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.test.yml b/tests/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.test.yml new file mode 100644 index 0000000000..1e25836ab5 --- /dev/null +++ b/tests/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.test.yml @@ -0,0 +1,11 @@ +name: Potential Pass the Token or Hash Observed by an Event Collecting Device - SSA Unit test +tests: + - name: Potential Pass the Token or Hash Observed by an Event Collecting Device + file: endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml + pass_condition: '@count_gt(0)' + description: Test Pass the Hash or Pass the Token Detection Observed by an Event Collecting Device + attack_data: + - file_name: ptt_pth_kerb_ntlm_anon_DC_dataset.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.002/extracts_from_real_data/ptt_pth_kerb_ntlm_anon_DC_dataset.log + source: WinEventLog:Security +