NetSYnc attack

title: NetSYnc attack
description: NetSync allows an attacker to take the NTLM hash of a Domain Controller (DC) machine account ("usually" identified by ending in "$") and using it to obtain the NTLM machine account hash of another machine account through impersonation (similar to, but different from, DCSync). Where DCSync can obtain user account passwords, NetSync is limited to machine accounts. The other main differentiator between DCSync and NetSync is that DCSync will make use of Microsoft's Directory Replication Service (DRS) Remote Protocol, whereas NetSync uses the older Netlogon Remote Protocol (MS-NRPC)
correlation: ID 5145 SubjectLogonId 0x1f4a6c852 AND ID 4624 TargetLogonId 0x1f4a6c852
references:
- https://github.com/Neo23x0/sigma/blob/c56cd2dfff6343f3694ef4fd606a305415599737/rules-unsupported/win_dumping_ntdsdit_via_netsync.yml
- https://fr.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
- https://www.trustedsec.com/blog/the-tale-of-the-lost-but-not-forgotten-undocumented-netsync-part-1/
- https://www.trustedsec.com/blog/the-tale-of-the-lost-but-not-forgotten-undocumented-netsync-part-2/
tags:
- attack.credential_access
- attack.t1003.006
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection: #  lsadump::netsync /dc:<dc_fqdn> /user:dc1$ /ntlm:<ntlmhash> /account:srv02$

  selection_login:
    EventID: 4624
    Computer: '%domain_controllers%'
    TargetUserSid: S-1-5-21-
    LogonType: 3
    AuthenticationPackageName: Kerberos

  selection_share:
    EventID: 5145
    Computer: '%domain_controllers%'
    ShareName: \\*\IPC$
    RelativeTargetName: NETLOGON

  filter:
    - SubjectUserName|endswith: $
    - SubjectUserSid: S-1-5-7 #  ANONYMOUS LOGON
    - IpAddress:
      - '%domain_controllers%'
      - '%exchange_servers%'

  condition: selection_login and selection_share and not filter
falsepositives:
- Exchange servers
level: high