User password change without previous password known - SetNTLM (Mimikatz)

Status: experimental
Severity: high
Log source: product windows, service security
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker perform a password reset event. This does not require any knowledge of a user’s current password, but it does require to have the "Reset Password" right. Correlate the event ID 4724, 4624 and 5145 using the "SubjectLogonId" field to identify the source of the reset.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1098` Account Manipulation

Event coverage

Provider	Event	Title
Security-Auditing	Event ID 4624	An account was successfully logged on.
Security-Auditing	Event ID 4724	An attempt was made to reset an account's password.
Security-Auditing	Event ID 5145	A network share object was checked to see whether client can be granted desired access.

Rule body yaml

title: User password change without previous password known - SetNTLM (Mimikatz)
description: Detects scenarios where an attacker perform a password reset event. This does not require any knowledge of a user’s current password, but it does require to have the "Reset Password" right. Correlate the event ID 4724, 4624 and 5145 using the "SubjectLogonId" field to identify the source of the reset.
references:
  - https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1098.xxx-Account%20manipulation
  - https://stealthbits.com/blog/manipulating-user-passwords-with-mimikatz/
  - https://www.trustedsec.com/blog/azure-account-hijacking-using-mimikatzs-lsadumpsetntlm/
  - https://www.trustedsec.com/blog/manipulating-user-passwords-without-mimikatz/
tags:
  - attack.persistence
  - attack.t1098
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection_reset:
    EventID: 4724 # Non self password reset
    TargetSid|startswith: S-1-5-21-
    SubjectUserSid|startswith: S-1-5-21-

  selection_share:
    EventID: 5145
    ShareName: \\*\IPC$
    RelativeTargetName: samr

  selection_login:
    EventID: 4624
    AuthenticationPackageName: NTLM

  filter:
    IpAddress:
      - "127.0.0.1"
      - "::1"

  condition: (selection_reset and selection_share and selection_login) and not filter
falsepositives:
  - None
level: high

Stages and Predicates

Stage 0: `condition`

(selection_reset and selection_share and selection_login) and not filter

Stage 1: `selection_reset`

selection_reset:
  EventID: 4724
  TargetSid|startswith: S-1-5-21-
  SubjectUserSid|startswith: S-1-5-21-

Stage 2: `selection_share`

selection_share:
  EventID: 5145
  ShareName: \\*\IPC$
  RelativeTargetName: samr

Stage 3: `selection_login`

selection_login:
  EventID: 4624
  AuthenticationPackageName: NTLM

Stage 4: `not filter`

filter:
  IpAddress:
    - "127.0.0.1"
    - "::1"

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

Field	Kind	Excluded values
`IpAddress`	eq	`127.0.0.1`
`IpAddress`	eq	`::1`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`AuthenticationPackageName`	eq	`NTLM` corpus 9 (sigma 5, elastic 2, splunk 1, kusto 1)
`RelativeTargetName`	eq	`samr` corpus 2 (sigma 2)
`ShareName`	wildcard	`\\*\IPC$` corpus 11 (sigma 11)
`SubjectUserSid`	starts_with	`S-1-5-21-` corpus 5 (sigma 5)
`TargetSid`	starts_with	`S-1-5-21-` corpus 4 (sigma 4)

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

User password change without previous password known - SetNTLM (Mimikatz)

MITRE ATT&CK coverage

Event coverage

Rule body yaml

Stages and Predicates

Stage 0: `condition`

Stage 1: `selection_reset`

Stage 2: `selection_share`

Stage 3: `selection_login`

Stage 4: `not filter`

Exclusions

Indicators

Keyboard shortcuts

Search operators

User password change without previous password known - SetNTLM (Mimikatz)

MITRE ATT&CK coverage

Event coverage

Rule body yaml

Stages and Predicates

Stage 0: condition

Stage 1: selection_reset

Stage 2: selection_share

Stage 3: selection_login

Stage 4: not filter

Exclusions

Indicators

Stage 0: `condition`

Stage 1: `selection_reset`

Stage 2: `selection_share`

Stage 3: `selection_login`

Stage 4: `not filter`