detection.wiki

Detection rules › Splunk

Crowdstrike Admin Weak Password Policy

Status
production
Severity
medium
Group by
dn, domain, primaryDisplayName, riskScore, riskScoreSeverity, risk_type, role_type, severity, user
Author
Teoderick Contreras, Splunk
Source
github.com/splunk/security_content

The following analytic detects CrowdStrike alerts for admin weak password policy violations, identifying instances where administrative passwords do not meet security standards. These alerts highlight significant vulnerabilities that could be exploited by attackers to gain unauthorized access. Promptly addressing these alerts is crucial for maintaining robust security and protecting critical systems and data from potential threats.

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1110 Brute Force

Rule body splunk

name: Crowdstrike Admin Weak Password Policy
id: bb1481fd-23c0-4195-b6a0-94d746c9637c
version: 9
creation_date: '2024-07-31'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects CrowdStrike alerts for admin weak password policy violations, identifying instances where administrative passwords do not meet security standards. These alerts highlight significant vulnerabilities that could be exploited by attackers to gain unauthorized access. Promptly addressing these alerts is crucial for maintaining robust security and protecting critical systems and data from potential threats.
data_source: []
search: |-
    `crowdstrike_identities` primaryDisplayName = "*admin*"
      | rename riskFactors{}.severity as severity, riskFactors{}.type as risk_type, roles{}.type as role_type, accounts{}.domain as domain, accounts{}.dn as dn, accounts{}.samAccountName as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY domain dn primaryDisplayName
           risk_type severity riskScore
           riskScoreSeverity user role_type
      | where risk_type = "WEAK_PASSWORD_POLICY"
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `crowdstrike_admin_weak_password_policy_filter`
how_to_implement: To implement crowdstrike:identities logs, use the Falcon Streaming API. Set up an API client, authenticate with your CrowdStrike credentials, and subscribe to the "crowdstrike:identities" event stream. Process and store the logs as needed, integrating them into your logging or SIEM system for monitoring and analysis.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.crowdstrike.com/wp-content/uploads/2022/12/CrowdStrike-Falcon-Event-Streams-Add-on-Guide-v3.pdf
drilldown_searches:
    - name: View the detection results for - "$user$"
      search: '%original_detection_search% | search  user = "$user$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$user$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: 7d
      latest_offset: "0"
finding:
    title: Weak Password for Admin User found on $domain$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Compromised Windows Host
asset_type: Endpoint
mitre_attack_id:
    - T1110
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/crowdstrike_stream/admin_weak_password_policy/crowdstrike_weak_password_admin_cleaned.log
          sourcetype: crowdstrike:identities
          source: crowdstrike:identities
      test_type: unit

Stages and Predicates

Stage 1: search

`crowdstrike_identities` primaryDisplayName = "*admin*"

Stage 2: rename

| rename riskFactors{}.severity as severity, riskFactors{}.type as risk_type, roles{}.type as role_type, accounts{}.domain as domain, accounts{}.dn as dn, accounts{}.samAccountName as user

Stage 3: stats

| stats count min(_time) as firstTime max(_time) as lastTime
    BY domain dn primaryDisplayName
       risk_type severity riskScore
       riskScoreSeverity user role_type

Stage 4: where

| where risk_type = "WEAK_PASSWORD_POLICY"

Stage 5: search

| `security_content_ctime(firstTime)`

Stage 6: search

| `security_content_ctime(lastTime)`

Stage 7: search

| `crowdstrike_admin_weak_password_policy_filter`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
primaryDisplayNameeq
  • "*admin*" corpus 2 (splunk 2)
risk_typeeq
  • "WEAK_PASSWORD_POLICY" corpus 2 (splunk 2)
sourcetypeeq
  • crowdstrike:identities corpus 6 (splunk 6)