detection.wiki

Detection rules › Kusto

DumpGuard NTLM challenge detected

Author
Robbe Van den Daele
Source
github.com/HybridBrothers/Hunting-Queries-Detection-Rules

With the DumpGuard tool, attackers are able to dump credetials via Remote Credential Guard on devices that have Credential Guard enabled. The creator of the DumpGuard tool purposely used a hard-coded NTLMv1 challenge into the tool, for easy detection. > [!WARNING] > Since the detection relies on a static IOC that can easily be changed in the source code, this detection has a low confidence score since it can be easily bypassed. However, if the detection hits it is almost 100% certain the alert will be TP. > Also take into account that the NetworkSignatureInspected ActionType in MDE is sampled, which means not very event will be logged.

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1003.004 OS Credential Dumping: LSA Secrets

References

Event coverage

ProviderEvent/ActionTypeTitle
Defender-DeviceNetworkEventsNetworkSignatureInspectedNetwork signature inspected
Windows-DefenderEvent ID 1116Event ID 1116
Windows-DefenderEvent ID 1117Event ID 1117

Rule body yaml

DeviceNetworkEvents
// Get NTLM Challenges
| where ActionType == "NetworkSignatureInspected"
| where tostring(todynamic(AdditionalFields).SignatureName) =~ "NTLM-Challenge"
// Extract the NTLM Sample Packet
| extend SamplePacketContent = extract('\\["(.+)"\\]', 1, tostring(todynamic(AdditionalFields).SamplePacketContent))
// Remove % values, since the '1122334455667788' is easy to find without conversions
| extend NewSamplePacketContent = strcat_array(split(SamplePacketContent, "%"), "")
| where NewSamplePacketContent contains "1122334455667788"

Stages and Predicates

Stage 1: source

DeviceNetworkEvents

Stage 2: where

| where ActionType == "NetworkSignatureInspected"

Stage 3: where

| where tostring(todynamic(AdditionalFields).SignatureName) =~ "NTLM-Challenge"

Stage 4: extend

| extend SamplePacketContent = extract('\\["(.+)"\\]', 1, tostring(todynamic(AdditionalFields).SamplePacketContent))

Stage 5: extend

| extend NewSamplePacketContent = strcat_array(split(SamplePacketContent, "%"), "")

Stage 6: where

| where NewSamplePacketContent contains "1122334455667788"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ActionTypeeq
  • NetworkSignatureInspected transforms: cased
NewSamplePacketContentcontains
  • 1122334455667788
SignatureNameeq
  • NTLM-Challenge transforms: tostring

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
SamplePacketContentextend
NewSamplePacketContentextend