Rubeus Password Change (Windows Event Log)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

The changepw module will take a user's TGT .kirbi blog and execute a MS kpasswd password change with the specified /new:PASSWORD value. If a /dc is not specified, the computer's current domain controller is extracted and used as the destination for the password reset traffic. This is the Aorato Kerberos password reset disclosed in 2014, and is equivalent to Kekeo's misc::changepw function.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts
Persistence	`T1078` Valid Accounts
Privilege Escalation	`T1078` Valid Accounts
Stealth	`T1078` Valid Accounts
Credential Access	`T1558` Steal or Forge Kerberos Tickets

References

https://github.com/GhostPack/Rubeus/blob/master/Rubeus/Commands/Changepw.cs

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4723: An attempt was made to change an account's password.
Security-Auditing	Event ID 4738: A user account was changed.

Rule body

id: '5471.5637'
title: Rubeus Password Change
description: The changepw module will take a user's TGT .kirbi blog and execute a
  MS kpasswd password change with the specified /new:PASSWORD value. If a /dc is not
  specified, the computer's current domain controller is extracted and used as the
  destination for the password reset traffic. This is the Aorato Kerberos password
  reset disclosed in 2014, and is equivalent to Kekeo's misc::changepw function.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4738) OR
  "<EventID>4738<") TERM(ANONYMOUS) TERM(LOGON) ) OR (TERM(EventCode=4723) OR "<EventID>4723<")
  | eval user=mvappend(coi_user, user) | table _time, host, user, signature_id, session_id,
  signature | bin span=5s | stats values(*) as * by _time, host | where match(signature_id,
  "4738") AND match(signature_id, "4723") '
techniques:
- persistence:valid accounts
- privilege-escalation:valid accounts
- defense-evasion:valid accounts
- credential-access:steal or forge kerberos tickets
technique_id: 
- T1078
- T1558
data_category:
- Windows event logs
references:
- https://github.com/GhostPack/Rubeus/blob/master/Rubeus/Commands/Changepw.cs

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4738) OR "<EventID>4738<") TERM(ANONYMOUS) TERM(LOGON) ) OR (TERM(EventCode=4723) OR "<EventID>4723<")

Stage 2: `eval`

| eval user=mvappend(coi_user, user)

Stage 3: `table`

| table _time, host, user, signature_id, session_id, signature

Stage 4: `bucket`

| bin span=5s

Stage 5: `stats`

| stats values(*) as * by _time, host

Stage 6: `where`

| where match(signature_id, "4738") AND match(signature_id, "4723")

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`4723` corpus 4 (splunk 3, kusto 1) `4738` corpus 8 (splunk 4, elastic 3, kusto 1)	`field:"EventID" kind:eq`
`signature_id`	regex_match	`"4723"` `"4738"`	`field:"signature_id" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"<EventID>4738<"`
1	`ANONYMOUS`
1	`LOGON`
1	`"<EventID>4723<"`