diff --git a/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_one_source_using_kerberos.yml b/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_one_source_using_kerberos.yml new file mode 100644 index 0000000000..860a4c50bc --- /dev/null +++ b/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_one_source_using_kerberos.yml @@ -0,0 +1,40 @@ +name: Multiple Disabled Users Failing To Authenticate From One Source Using Kerberos +id: 98f22d82-9d62-11eb-9fcf-acde48001122 +version: 1 +date: '2021-04-14' +author: Mauricio Velazco, Splunk +type: batch +datamodel: +- Endpoint +description: The following analytic identifies one source endpoint failing to authenticate with multiple disabled domain users using the Kerberos protocol. + This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain + initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. I certain scenarios, adversaries may execute a password spraying attack against disabled users. + In this logic, the number of unique users is hardcoded to '10' but can/should be customized to fit especific environments. + Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code 0x12 means + 'client’s credentials have been revoked' (account disabled, expired or locked out. + + This detection will trigger on the domain controller against which the offending host performs the password spraying attack. + + The analytic's returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. +search: 'EventCode=4768 Result_Code=0x12 | stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by Client_Address | where unique_accounts > 10' +how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting +'Audit Kerberos Authentication Service' within 'Account Logon' needs to be enabled. +known_false_positives: A host failing to authenticate with multiple disabled domain users is not a common behavior for legitimate systems. Possible false positive scenarios +include but are not limited to vulnerability scanners and missconfigured systems. +references: +tags: + analytic_story: + - Active Directory Password Spraying + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1110.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_one_source_using_kerberos_.yml b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_one_source_using_kerberos_.yml new file mode 100644 index 0000000000..f5311f970d --- /dev/null +++ b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_one_source_using_kerberos_.yml @@ -0,0 +1,40 @@ +name: Multiple Invalid Users Failing To Authenticate From One Source Using Kerberos +id: 001266a6-9d5b-11eb-829b-acde48001122 +version: 1 +date: '2021-04-14' +author: Mauricio Velazco, Splunk +type: batch +datamodel: +- Endpoint +description: The following analytic identifies one source endpoint failing to authenticate with multiple invalid domain users using the Kerberos protocol. + This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain + initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. I certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. + In this logic, the number of unique users is hardcoded to '10' but can/should be customized to fit especific environments. + Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code 0x6 means + 'client not found in Kerberos database' (the attempted user is not a valid domain user). + + This detection will trigger on the domain controller against which the offending host performs the password spraying attack. + + The analytic's returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. +search: 'EventCode=4768 Result_Code=0x6 | stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by Client_Address | where unique_accounts > 10 ' +how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting +'Audit Kerberos Authentication Service' within 'Account Logon' needs to be enabled. +known_false_positives: A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios +include but are not limited to vulnerability scanners and missconfigured systems. +references: +tags: + analytic_story: + - Active Directory Password Spraying + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1110.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_source_using_kerberos.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_source_using_kerberos.yml index 2f7a6aed66..4039ce7a54 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_source_using_kerberos.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_source_using_kerberos.yml @@ -1,4 +1,4 @@ -name: Multiple Valid Users Failing To Autheticate From One Source Using Kerberos +name: Multiple Valid Users Failing To Authenticate From One Source Using Kerberos id: 3a91a212-98a9-11eb-b86a-acde48001122 version: 1 date: '2021-04-08' diff --git a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_one_source_against_multiple_targets.yml b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_one_source_against_multiple_targets.yml new file mode 100644 index 0000000000..59015c2345 --- /dev/null +++ b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_one_source_against_multiple_targets.yml @@ -0,0 +1,42 @@ +name: Multiple Users Remotely Failing To Authenticate From One Source Against Multiple Targets +id: e345917c-9ded-11eb-a15f-acde48001122 +version: 1 +date: '2021-04-15' +author: Mauricio Velazco, Splunk +type: batch +datamodel: +- Endpoint +description: The following analytic identifies a source host failing to authenticate against several remote hosts with multiple users in a distributed way. +This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. + In this logic, the number of unique users is hardcoded to '10' but can/should be customized to fit especific environments. + Event 4625 documents each and every failed attempt to logon to the local computer. This event generates on domain controllers, member servers and workstations. Logon Type 3 + describes an remote authentication attempt. + + This detection will trigger on the hosts that are the targets of the password spraying attack. These could be domain controllers and/or member servers or workstations. + + The analytic's returned fields allow analysts to investigate the event further by providing fields like source ip, target hosts and target users. + +search: 'EventCode=4625 Logon_Type=3 Source_Network_Address!="-" | eval Destination_Account = mvindex(Account_Name, 1) | stats dc(Destination_Account) AS unique_accounts values(ComputerName) as target_hosts values(Destination_Account) as tried_accounts by Source_Network_Address | where unique_accounts > 3' +how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as +as well as member servers and workstations. The Advanced Security Audit policy setting 'Audit Logon' within 'Logon/Logoff' needs to be enabled. +known_false_positives: A host failing to authenticate with multiple users against multiple targets is not common behavior for a legitimate system. Possible false positive scenarios +include but are not limited to vulnerability scanners, remote administration tools and missconfigured systems. +references: + - https://attack.mitre.org/techniques/T1110/003/ + - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625 + - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625 + - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events +tags: + analytic_story: + - Active Directory Password Spraying + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1110.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_source.yml b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_source.yml index 6dd7642c60..469e7265c7 100644 --- a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_source.yml +++ b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_source.yml @@ -29,9 +29,7 @@ references: - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events tags: analytic_story: - - UPDATE_STORY_NAME - dataset: - - UPDATE_DATASET_URL + - Active Directory Password Spraying kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/tests/endpoint/multiple_disabled_users_failing_to_authenticate_from_one_source_using_kerberos.test.yml b/tests/endpoint/multiple_disabled_users_failing_to_authenticate_from_one_source_using_kerberos.test.yml new file mode 100644 index 0000000000..3cbc282cc5 --- /dev/null +++ b/tests/endpoint/multiple_disabled_users_failing_to_authenticate_from_one_source_using_kerberos.test.yml @@ -0,0 +1,12 @@ +name: Multiple Disabled Users Failing To Authenticate From One Source Using Kerberos Unit Test +tests: +- name: Multiple Disabled Users Failing To Authenticate From One Source Using Kerberos + file: detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_one_source_using_kerberos.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/endpoint/multiple_invalid_users_failing_to_authenticate_from_one_source_using_kerberos_.test.yml b/tests/endpoint/multiple_invalid_users_failing_to_authenticate_from_one_source_using_kerberos_.test.yml new file mode 100644 index 0000000000..8c20a89f85 --- /dev/null +++ b/tests/endpoint/multiple_invalid_users_failing_to_authenticate_from_one_source_using_kerberos_.test.yml @@ -0,0 +1,12 @@ +name: Multiple Invalid Users Failing To Authenticate From One Source Using Kerberos Unit Test +tests: +- name: Multiple Invalid Users Failing To Authenticate From One Source Using Kerberos + file: detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_one_source_using_kerberos_.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/endpoint/multiple_users_failing_to_authenticate_from_source_using_kerberos.test.yml b/tests/endpoint/multiple_users_failing_to_authenticate_from_source_using_kerberos.test.yml index 4c4b6b0463..9e7e025507 100644 --- a/tests/endpoint/multiple_users_failing_to_authenticate_from_source_using_kerberos.test.yml +++ b/tests/endpoint/multiple_users_failing_to_authenticate_from_source_using_kerberos.test.yml @@ -1,6 +1,6 @@ -name: Multiple Valid Users Failing To Autheticate From One Source Using Kerberos Unit Test +name: Multiple Valid Users Failing To Authenticate From One Source Using Kerberos Unit Test tests: -- name: Multiple Valid Users Failing To Autheticate From One Source Using Kerberos +- name: Multiple Valid Users Failing To Authenticate From One Source Using Kerberos file: endpoint/multiple_users_failing_to_authenticate_from_source_using_kerberos.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' diff --git a/tests/endpoint/multiple_users_remotely_failing_to_authenticate_from_one_source_against_multiple_targets.test.yml b/tests/endpoint/multiple_users_remotely_failing_to_authenticate_from_one_source_against_multiple_targets.test.yml new file mode 100644 index 0000000000..d475689fca --- /dev/null +++ b/tests/endpoint/multiple_users_remotely_failing_to_authenticate_from_one_source_against_multiple_targets.test.yml @@ -0,0 +1,12 @@ +name: Multiple Users Remotely Failing To Authenticate From One Source Against Multiple Targets Unit Test +tests: +- name: Multiple Users Remotely Failing To Authenticate From One Source Against Multiple Targets + file: detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_one_source_against_multiple_targets.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file