Mimikatz Pass-the-hash login

Status: experimental
Severity: high
Log source: product windows, service security
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker uses the Mimikatz Pass-the-hash feature to move laterally. Correlation with others event IDs can be done in the following way:| ID 4624 TargetLogonId + ID 4672 SubjectLogonId + ID 4688 TargetLogonId. Having those 3 elements together allows to bring in light what was exactly done.

Known false positives

Runas.exe executed with /netonly parameter

MITRE ATT&CK coverage

Tactic	Techniques
Lateral Movement	`T1550.002` Use Alternate Authentication Material: Pass the Hash

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4624: An account was successfully logged on.

Rule body

title: Mimikatz Pass-the-hash login
description: Detects scenarios where an attacker uses the Mimikatz Pass-the-hash feature to move laterally. Correlation with others event IDs can be done in the following way:| ID 4624 TargetLogonId + ID 4672 SubjectLogonId + ID 4688 TargetLogonId. Having those 3 elements together allows to bring in light what was exactly done.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0008-Lateral%20Movement/T1550-Use%20Alternate%20Authentication%20Material
- https://stealthbits.com/blog/passing-the-hash-with-mimikatz/
- https://s3cur3th1ssh1t.github.io/Named-Pipe-PTH/
- https://thedfirreport.com/2022/11/14/bumblebee-zeros-in-on-meterpreter/
- https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/
tags:
- attack.lateral_movement
- attack.t1550.002
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection: # command: 'privilege::debug' + 'sekurlsa::pth /user:<user> /domain:<domain> /ntlm:<hash> /run:<command>'
  selection:
    EventID: 4624
    LogonType: 9 # New credentials
    LogonProcessName: seclogo
    AuthenticationPackageName: Negotiate
    ProcessName: 'C:\Windows\System32\svchost.exe'
    IpAddress: '::1'
  #filter: # if 'token::elevate' command is used, both Subject and Target will be related to SYSTEM account. Therefore the filter needs to be removed.
    #SubjectUserName|endswith: '$'
    #TargetUserName|endswith: '$'
  condition: selection and not filter
falsepositives:
- Runas.exe executed with /netonly parameter
level: high

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
  EventID: 4624
  LogonType: 9
  LogonProcessName: seclogo
  AuthenticationPackageName: Negotiate
  ProcessName: 'C:\Windows\System32\svchost.exe'
  IpAddress: '::1'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AuthenticationPackageName`	eq	`Negotiate` corpus 4 (sigma 4)	`field:"AuthenticationPackageName" kind:eq value:"Negotiate"`
`IpAddress`	eq	`::1` corpus 7 (sigma 6, elastic 1)	`field:"src_ip" kind:eq value:"::1"`
`LogonProcessName`	eq	`seclogo` corpus 5 (sigma 4, elastic 1)	`field:"LogonProcessName" kind:eq value:"seclogo"`
`LogonType`	eq	`9` corpus 8 (sigma 6, elastic 2)	`field:"LogonType" kind:eq value:"9"`
`ProcessName`	eq	`C:\Windows\System32\svchost.exe`	`field:"process_name" kind:eq value:"C:\Windows\System32\svchost.exe"`