Detection rules › Splunk
Rubeus Password Change (Windows Event Log)
The changepw module will take a user's TGT .kirbi blog and execute a MS kpasswd password change with the specified /new:PASSWORD value. If a /dc is not specified, the computer's current domain controller is extracted and used as the destination for the password reset traffic. This is the Aorato Kerberos password reset disclosed in 2014, and is equivalent to Kekeo's misc::changepw function.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1078 Valid Accounts |
| Persistence | T1078 Valid Accounts |
| Privilege Escalation | T1078 Valid Accounts |
| Stealth | T1078 Valid Accounts |
| Credential Access | T1558 Steal or Forge Kerberos Tickets |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4723 | An attempt was made to change an account's password. |
| Security-Auditing | Event ID 4738 | A user account was changed. |
Rule body yaml
id: '5471.5637'
title: Rubeus Password Change
description: The changepw module will take a user's TGT .kirbi blog and execute a
MS kpasswd password change with the specified /new:PASSWORD value. If a /dc is not
specified, the computer's current domain controller is extracted and used as the
destination for the password reset traffic. This is the Aorato Kerberos password
reset disclosed in 2014, and is equivalent to Kekeo's misc::changepw function.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4738) OR
"<EventID>4738<") TERM(ANONYMOUS) TERM(LOGON) ) OR (TERM(EventCode=4723) OR "<EventID>4723<")
| eval user=mvappend(coi_user, user) | table _time, host, user, signature_id, session_id,
signature | bin span=5s | stats values(*) as * by _time, host | where match(signature_id,
"4738") AND match(signature_id, "4723") '
techniques:
- persistence:valid accounts
- privilege-escalation:valid accounts
- defense-evasion:valid accounts
- credential-access:steal or forge kerberos tickets
technique_id:
- T1078
- T1558
data_category:
- Windows event logs
references:
- https://github.com/GhostPack/Rubeus/blob/master/Rubeus/Commands/Changepw.cs
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4738) OR "<EventID>4738<") TERM(ANONYMOUS) TERM(LOGON) ) OR (TERM(EventCode=4723) OR "<EventID>4723<")
Stage 2: eval
| eval user=mvappend(coi_user, user)
Stage 3: table
| table _time, host, user, signature_id, session_id, signature
Stage 4: bucket
| bin span=5s
Stage 5: stats
| stats values(*) as * by _time, host
Stage 6: where
| where match(signature_id, "4738") AND match(signature_id, "4723")
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
signature_id | match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4738<" |
| 1 | TERM |
| 1 | ANONYMOUS |
| 1 | TERM |
| 1 | LOGON |
| 1 | TERM |
| 1 | "<EventID>4723<" |