Exchange server impersonation via PrivExchange relay attack

Status: experimental
Severity: high
Log source: product windows, service security
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker relays Exchange server authentication to abuse Exchange servers permissions and escalate privileges.

Known false positives

None

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1557.001` Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4624: An account was successfully logged on.

Rule body

title: Exchange server impersonation via PrivExchange relay attack
description: Detects scenarios where an attacker relays Exchange server authentication to abuse Exchange servers permissions and escalate privileges.
references:
- https://dirkjanm.io/abusing-exchange-one-api-call-away-from-domain-admin/
- https://twitter.com/_dirkjan/status/1091632489561575424?s=20
tags:
- attack.credential_access
- attack.t1557.001
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    AuthenticationPackageName: NTLM
    LogonProcessName: NtLmSsp
    LogonType: 3
    Computer: '%domain_controllers%' # Logon event has to be generated on a DC
    TargetUserName: # Exchange server HOSTNAMES list + "$"
      - SRVEXCH01$
      - SRVEXCH02$
      - SRVEXCH03$
  filter:
    IpAddress: '%exchange_server_ips%' # Source has to be attacker relay
  condition: selection and not filter
falsepositives:
- None
level: high

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
  EventID: 4624
  AuthenticationPackageName: NTLM
  LogonProcessName: NtLmSsp
  LogonType: 3
  Computer: '%domain_controllers%'
  TargetUserName:
    - SRVEXCH01$
    - SRVEXCH02$
    - SRVEXCH03$

Stage 2: `not filter`

filter:
  IpAddress: '%exchange_server_ips%'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`IpAddress`	eq	`%exchange_server_ips%`	`excludes:IpAddress` `field:"IpAddress" value:"%exchange_server_ips%"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AuthenticationPackageName`	eq	`NTLM` corpus 7 (sigma 5, elastic 1, splunk 1)	`field:"AuthenticationPackageName" kind:eq value:"NTLM"`
`Computer`	eq	`%domain_controllers%` corpus 3 (sigma 3)	`field:"Computer" kind:eq value:"%domain_controllers%"`
`LogonProcessName`	eq	`NtLmSsp` corpus 2 (sigma 2)	`field:"LogonProcessName" kind:eq value:"NtLmSsp"`
`LogonType`	eq	`3` corpus 41 (splunk 13, sigma 12, elastic 9, kusto 7)	`field:"LogonType" kind:eq value:"3"`
`TargetUserName`	eq	`SRVEXCH01$` `SRVEXCH02$` `SRVEXCH03$`	`field:"TargetUserName" kind:eq`