Detection rules › Sigma
User password change using current hash password - ChangeNTLM (Mimikatz)
Detects scenarios where an attacker resets a user account by using the compromised NTLM password hash. The newly clear text password defined by the attacker can be then used in order to login into services like Outlook Web Access (OWA), RDP, SharePoint... As ID 4723 refers to user changing is own password, the SubjectSid and TargetSid should be equal. However in a change initiated by Mimikatz, they will be different. Correlate the event ID 4723, 4624 and 5145 using the "SubjectLogonId" field to identify the source of the reset.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1098 Account Manipulation |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4723 | An attempt was made to change an account's password. |
Rule body yaml
title: User password change using current hash password - ChangeNTLM (Mimikatz)
description: Detects scenarios where an attacker resets a user account by using the compromised NTLM password hash. The newly clear text password defined by the attacker can be then used in order to login into services like Outlook Web Access (OWA), RDP, SharePoint... As ID 4723 refers to user changing is own password, the SubjectSid and TargetSid should be equal. However in a change initiated by Mimikatz, they will be different. Correlate the event ID 4723, 4624 and 5145 using the "SubjectLogonId" field to identify the source of the reset.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1098.xxx-Account%20manipulation
- https://stealthbits.com/blog/manipulating-user-passwords-with-mimikatz/
- https://www.trustedsec.com/blog/azure-account-hijacking-using-mimikatzs-lsadumpsetntlm/
- https://www.trustedsec.com/blog/manipulating-user-passwords-without-mimikatz/
tags:
- attack.persistence
- attack.t1098
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 4723 # Self password reset
TargetSid|startswith: S-1-5-21-
SubjectUserSid|startswith: S-1-5-21-
#SubjectUserSid != TargetSid # comparing 2 fields is not possible in SIGMA language
condition: selection
falsepositives:
- Admin changing is own account directly using the Active Directory console and not the GUI (ctrl alt suppr)
- ADFS, MSOL, DirSync, Azure AD Sync
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
EventID: 4723
TargetSid|startswith: S-1-5-21-
SubjectUserSid|startswith: S-1-5-21-
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
SubjectUserSid | starts_with |
|
TargetSid | starts_with |
|