Pass-the-Hash (Windows Event Log)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

Detect when pass-the-hash techniques are utilized with computer or user accounts as in the most notable ZeroLogon exploit scenario after a computer account password has been reset.

MITRE ATT&CK coverage

Tactic	Techniques
Lateral Movement	`T1550.002` Use Alternate Authentication Material: Pass the Hash

References

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4624: An account was successfully logged on.

Rule body

id: '5383.5493'
title: Pass-the-Hash
description: Detect when pass-the-hash techniques are utilized with computer or user
  accounts as in the most notable ZeroLogon exploit scenario after a computer account
  password has been reset.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4624) OR
  "<EventID>4624<") Logon_Type=3 Authentication_Package=NTLM) | regex user="\$$" |
  rex field=_raw "Account Name:\s+(?<user>\S+\$)" | table _time, host, user signature_id,
  src_ip, Authentication_Package | bin span=1s | stats values(*) as * by _time, host '
techniques:
- lateral-movement:use alternate authentication material:pass the hash
technique_id:
- T1550.002
data_category:
- Windows event logs
references:
- https://www.cyberark.com/resources/threat-research-blog/detecting-pass-the-hash-with-windows-event-viewer
- https://www.binarydefense.com/reliably-detecting-pass-the-hash/

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4624) OR "<EventID>4624<") Logon_Type=3 Authentication_Package=NTLM)

Stage 2: `regex`

| regex user="\$$"

Stage 3: `rex`

| rex field=_raw "Account Name:\s+(?<user>\S+\$)"

Stage 4: `table`

| table _time, host, user signature_id, src_ip, Authentication_Package

Stage 5: `bucket`

| bin span=1s

Stage 6: `stats`

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Authentication_Package`	eq	`NTLM` corpus 3 (splunk 3)	`field:"Authentication_Package" kind:eq value:"NTLM"`
`EventCode`	eq	`4624` corpus 29 (splunk 13, kusto 11, chronicle 4, elastic 1)	`field:"EventID" kind:eq value:"4624"`
`Logon_Type`	eq	`3` corpus 41 (splunk 13, sigma 12, elastic 9, kusto 7)	`field:"LogonType" kind:eq value:"3"`
`user`	regex_match	`"$$"`	`field:"user" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"<EventID>4624<"`