User password change without previous password known - SetNTLM (Mimikatz)

Status: experimental
Severity: high
Log source: product windows, service security
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker perform a password reset event. This does not require any knowledge of a user’s current password, but it does require to have the "Reset Password" right. Correlate the event ID 4724, 4624 and 5145 using the "SubjectLogonId" field to identify the source of the reset.

Known false positives

None

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1098` Account Manipulation

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4624: An account was successfully logged on.
Security-Auditing	Event ID 4724: An attempt was made to reset an account's password.
Security-Auditing	Event ID 5145: A network share object was checked to see whether client can be granted desired access.

Rule body

title: User password change without previous password known - SetNTLM (Mimikatz)
description: Detects scenarios where an attacker perform a password reset event. This does not require any knowledge of a user’s current password, but it does require to have the "Reset Password" right. Correlate the event ID 4724, 4624 and 5145 using the "SubjectLogonId" field to identify the source of the reset.
references:
  - https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1098.xxx-Account%20manipulation
  - https://stealthbits.com/blog/manipulating-user-passwords-with-mimikatz/
  - https://www.trustedsec.com/blog/azure-account-hijacking-using-mimikatzs-lsadumpsetntlm/
  - https://www.trustedsec.com/blog/manipulating-user-passwords-without-mimikatz/
tags:
  - attack.persistence
  - attack.t1098
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection_reset:
    EventID: 4724 # Non self password reset
    TargetSid|startswith: S-1-5-21-
    SubjectUserSid|startswith: S-1-5-21-

  selection_share:
    EventID: 5145
    ShareName: \\*\IPC$
    RelativeTargetName: samr

  selection_login:
    EventID: 4624
    AuthenticationPackageName: NTLM

  filter:
    IpAddress:
      - "127.0.0.1"
      - "::1"

  condition: (selection_reset and selection_share and selection_login) and not filter
falsepositives:
  - None
level: high

Stages and Predicates

Stage 0: `condition`

(selection_reset and selection_share and selection_login) and not filter

Stage 1: `selection_reset`

selection_reset:
  EventID: 4724
  TargetSid|startswith: S-1-5-21-
  SubjectUserSid|startswith: S-1-5-21-

Stage 2: `selection_share`

selection_share:
  EventID: 5145
  ShareName: \\*\IPC$
  RelativeTargetName: samr

Stage 3: `selection_login`

selection_login:
  EventID: 4624
  AuthenticationPackageName: NTLM

Stage 4: `not filter`

filter:
  IpAddress:
    - "127.0.0.1"
    - "::1"

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`IpAddress`	eq	`127.0.0.1`	`excludes:IpAddress` `field:"IpAddress" value:"127.0.0.1"`
`IpAddress`	eq	`::1`	`excludes:IpAddress` `field:"IpAddress" value:"::1"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AuthenticationPackageName`	eq	`NTLM` corpus 7 (sigma 5, elastic 1, splunk 1)	`field:"AuthenticationPackageName" kind:eq value:"NTLM"`
`RelativeTargetName`	eq	`samr` corpus 2 (sigma 2)	`field:"RelativeTargetName" kind:eq value:"samr"`
`ShareName`	wildcard	`\\*\IPC$` corpus 11 (sigma 11)	`field:"ShareName" kind:wildcard value:"\\*\IPC$"`
`SubjectUserSid`	starts_with	`S-1-5-21-` corpus 5 (sigma 5)	`field:"SubjectUserSid" kind:starts_with value:"S-1-5-21-"`
`TargetSid`	starts_with	`S-1-5-21-` corpus 4 (sigma 4)	`field:"TargetSid" kind:starts_with value:"S-1-5-21-"`