User password change using current hash password - ChangeNTLM (Mimikatz)

title: User password change using current hash password - ChangeNTLM (Mimikatz)
description: Detects scenarios where an attacker resets a user account by using the compromised NTLM password hash. The newly clear text password defined by the attacker can be then used in order to login into services like Outlook Web Access (OWA), RDP, SharePoint... As ID 4723 refers to user changing is own password, the SubjectSid and TargetSid should be equal. However in a change initiated by Mimikatz, they will be different. Correlate the event ID 4723, 4624 and 5145 using the "SubjectLogonId" field to identify the source of the reset.
references:
  - https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1098.xxx-Account%20manipulation
  - https://stealthbits.com/blog/manipulating-user-passwords-with-mimikatz/
  - https://www.trustedsec.com/blog/azure-account-hijacking-using-mimikatzs-lsadumpsetntlm/
  - https://www.trustedsec.com/blog/manipulating-user-passwords-without-mimikatz/
tags:
  - attack.persistence
  - attack.t1098
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4723 # Self password reset
    TargetSid|startswith: S-1-5-21-
    SubjectUserSid|startswith: S-1-5-21-
    #SubjectUserSid != TargetSid # comparing 2 fields is not possible in SIGMA language
  condition: selection
falsepositives:
  - Admin changing is own account directly using the Active Directory console and not the GUI (ctrl alt suppr)
  - ADFS, MSOL, DirSync, Azure AD Sync
level: high