Detection rules › Splunk
Suspicious Spool Authentication (Windows Event Log)
It is possible to trigger RPC call using SpoolService bug, commonly found in NTLM relay attacks
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1557.001 Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay |
| Collection | T1557.001 Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4624 | An account was successfully logged on. |
| Security-Auditing | Event ID 5145 | A network share object was checked to see whether client can be granted desired access. |
Rule body yaml
id: '5408.5525'
title: Suspicious Spool Authentication
description: 'It is possible to trigger RPC call using SpoolService bug, commonly
found in NTLM relay attacks. - Software Association: Ransom Cartel, Vice Society'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4624) OR
"<EventID>4624<") Authentication_Package=NTLM) OR ((TERM(EventCode=5145) OR "<EventID>5145<")
AND TERM(spoolss))| table _time, host, user signature_id, Account_Name, user, Relative_Target_Name,
signature_id, src_ip | bin span=5s | stats values(*) as * by _time, host, user |
where (match(signature_id, "(?i)4624") AND match(signature_id, "(?i)5145")) | eventstats
dc(src_ip) as dc_src_ip by host| where dc_src_ip>=1 '
techniques:
- credential-access:adversary-in-the-middle:llmnr/nbt-ns poisoning and smb relay
technique_id:
- T1557.001
data_category:
- Windows event logs
references:
- https://dirkjanm.io/a-different-way-of-abusing-zerologon/
- https://github.com/cube0x0/CVE-2021-1675
- https://securityaffairs.co/wordpress/119839/hacking/printnightmare-patch-bypass.html
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4624) OR "<EventID>4624<") Authentication_Package=NTLM) OR ((TERM(EventCode=5145) OR "<EventID>5145<") AND TERM(spoolss))
Stage 2: table
| table _time, host, user signature_id, Account_Name, user, Relative_Target_Name, signature_id, src_ip
Stage 3: bucket
| bin span=5s
Stage 4: stats
| stats values(*) as * by _time, host, user
Stage 5: where
| where (match(signature_id, "(?i)4624") AND match(signature_id, "(?i)5145"))
Stage 6: eventstats
| eventstats dc(src_ip) as dc_src_ip by host
Stage 7: where
| where dc_src_ip>=1
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Authentication_Package | eq |
|
EventCode | eq |
|
dc_src_ip | ge |
|
signature_id | match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4624<" |
| 1 | TERM |
| 1 | "<EventID>5145<" |
| 1 | TERM |
| 1 | spoolss |