mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
research bot
84 lines
2.7 KiB
YAML
84 lines
2.7 KiB
YAML
name: Detect Pass the Hash
|
|
id: 7cd8b9fa-6b0c-424f-92a6-9c5287a72f5f
|
|
version: 1
|
|
date: '2020-10-21'
|
|
author: Xiao Lin, Splunk
|
|
type: TTP
|
|
datamodel:
|
|
- Authentication
|
|
description: This search looks for specific authentication events from the Windows
|
|
Security Event logs to detect potential attempts using Pass-the-Hash technique.
|
|
search: ' | from read_ssa_enriched_events()
|
|
|
|
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
|
|
| eval signature_id=map_get(input_event, "signature_id"), authentication_type=map_get(input_event,
|
|
"authentication_type"), authentication_method=map_get(input_event, "authentication_method"),
|
|
origin_device_domain=map_get(input_event, "origin_device_domain"), dest_user_id=ucast(map_get(input_event,
|
|
"dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"),
|
|
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
|
|
|
|
| where (authentication_type="3" AND authentication_method="NtLmSsp") OR (authentication_type="9"
|
|
AND authentication_method="seclogo")
|
|
|
|
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
|
|
dest_user_id), body=create_map(["event_id", event_id, "authentication_type", authentication_type,
|
|
"authentication_method", authentication_method]) | into write_ssa_detected_events();'
|
|
how_to_implement: The test data is converted from Windows Security Event logs generated
|
|
from Attach Range simulation and used in SPL search and extended to SPL2
|
|
known_false_positives: Legitimate logon activity by authorized NTLM systems may be
|
|
detected by this search. Please investigate as appropriate.
|
|
references:
|
|
- Initial ESCU implementation by Bhavin Patel and Patrick Bareiss
|
|
tags:
|
|
analytic_story:
|
|
- Lateral Movement
|
|
cis20:
|
|
- CIS 3
|
|
- CIS 5
|
|
- CIS 16
|
|
confidence: 20
|
|
context:
|
|
- Source:AD
|
|
- Source:Endpoint
|
|
- Stage:Credential Access
|
|
impact: 80
|
|
kill_chain_phases:
|
|
- Actions on Objectives
|
|
message: Potential use of the pass the hash/token attacks that spoof authentication.
|
|
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
|
via command $cmd_line$
|
|
mitre_attack_id:
|
|
- T1550
|
|
- T1550.002
|
|
nist:
|
|
- PR.PT
|
|
- PR.AT
|
|
- PR.AC
|
|
- PR.IP
|
|
observable:
|
|
- name: dest_user_id
|
|
type: User
|
|
role:
|
|
- Actor
|
|
- name: dest_device_id
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
- name: cmd_line
|
|
type: processname
|
|
role:
|
|
- Others
|
|
product:
|
|
- Splunk Behavioral Analytics
|
|
required_fields:
|
|
- signature_id
|
|
- authentication_type
|
|
- _time
|
|
- authentication_method
|
|
- origin_device_domain
|
|
- dest_user_id
|
|
- dest_device_id
|
|
risk_score: 16
|
|
risk_severity: low
|
|
security_domain: endpoint
|