Techniques
Sample rules
Windows Unusual NTLM Authentication Destinations By Source
- source: splunk
- technicques:
- T1110
- T1110.003
Description
The following analytic detects when an unusual number NTLM authentications is attempted by the same source against multiple destinations. This activity generally results when an attacker attempts to brute force, password spray, or otherwise authenticate to a multiple domain joined Windows devices using an NTLM based process/attack. This same activity may also generate a large number of EventID 4776 events as well.
Detection logic
`ntlm_audit` EventCode = 8004 SChannelName=* WorkstationName=*
| eval src = replace(WorkstationName,"\\\\","") ```CIM alignment, remove leading \\ from some auth attempts ```
| eval dest = SChannelName, user = UserName ``` CIM alignment```
| where SChannelName!=src ``` Remove NTLM auths to self, improves accuracy for certain applications ```
| `windows_unusual_ntlm_authentication_destinations_by_source_filter`
| stats count min(_time) as firstTime max(_time) as lastTime dc(eval(upper(dest))) as unique_count by src
| eventstats avg(unique_count) as unique_avg , stdev(unique_count) as unique_std
| eval upperBound_unique=(1+unique_avg+unique_std*3) ``` adjust formula for sensitivity```
| eval isOutlier=CASE(unique_count > upperBound_unique, 1, true(), 0)
| where isOutlier==1
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
Windows Unusual NTLM Authentication Destinations By User
- source: splunk
- technicques:
- T1110
- T1110.003
Description
The following analytic detects when an unusual number of NTLM authentications is attempted by the same user account against multiple destinations. This activity generally results when an attacker attempts to brute force, password spray, or otherwise authenticate to numerous domain joined Windows devices using an NTLM based process/attack. This same activity may also generate a large number of EventID 4776 events as well.
Detection logic
`ntlm_audit` EventCode = 8004 SChannelName=* WorkstationName=*
| eval src = replace(WorkstationName,"\\\\","") ```CIM alignment, remove leading \\ from some auth attempts ```
| eval dest = SChannelName, user = UserName ``` CIM alignment```
| where SChannelName!=src ``` Remove NTLM auths to self, improves accuracy for certain applications ```
| `windows_unusual_ntlm_authentication_destinations_by_user_filter`
| stats count min(_time) as firstTime max(_time) as lastTime dc(eval(upper(dest))) as unique_count by user
| eventstats avg(unique_count) as unique_avg , stdev(unique_count) as unique_std
| eval upperBound_unique=(1+unique_avg+unique_std*3) ``` adjust formula for sensitivity```
| eval isOutlier=CASE(unique_count > upperBound_unique, 1, true(), 0)
| where isOutlier==1
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
Windows Unusual NTLM Authentication Users By Source
- source: splunk
- technicques:
- T1110
- T1110.003
Description
The following analytic detects when an unusual number of NTLM authentications is attempted by the same source. This activity generally results when an attacker attempts to brute force, password spray, or otherwise authenticate to a domain joined Windows device using an NTLM based process/attack. This same activity may also generate a large number of EventID 4776 events in as well.
Detection logic
`ntlm_audit` EventCode = 8004 SChannelName=* WorkstationName=*
| eval src = replace(WorkstationName,"\\\\","") ```CIM alignment, remove leading \\ from some auth attempts ```
| eval dest = SChannelName, user = UserName ``` CIM alignment```
| where SChannelName!=src ``` Remove NTLM auths to self, improves accuracy for certain applications ```
| `windows_unusual_ntlm_authentication_users_by_source_filter`
| stats count min(_time) as firstTime max(_time) as lastTime dc(eval(upper(user))) as unique_count by src
| eventstats avg(unique_count) as unique_avg , stdev(unique_count) as unique_std
| eval upperBound_unique=(1+unique_avg+unique_std*3) ``` adjust formula for sensitivity```
| eval isOutlier=CASE(unique_count > upperBound_unique, 1, true(), 0)
| where isOutlier==1
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
Windows Unusual NTLM Authentication Users By Destination
- source: splunk
- technicques:
- T1110
- T1110.003
Description
The following analytic detects when a device is the target of numerous NTLM authentications using a null domain. This activity generally results when an attacker attempts to brute force, password spray, or otherwise authenticate to a domain joined Windows device from a non-domain device. This activity may also generate a large number of EventID 4776 events in tandem, however these events will not indicate the attacker or target device.
Detection logic
`ntlm_audit` EventCode = 8004 SChannelName=* WorkstationName=*
| eval src = replace(WorkstationName,"\\\\","") ```CIM alignment, remove leading \\ from some auth attempts ```
| eval dest = SChannelName, user = UserName ``` CIM alignment```
| where SChannelName!=src ``` Remove NTLM auths to self, improves accuracy for certain applications ```
| `windows_unusual_ntlm_authentication_users_by_destination_filter`
| stats count min(_time) as firstTime max(_time) as lastTime dc(eval(upper(user))) as unique_count by dest
| eventstats avg(unique_count) as unique_avg , stdev(unique_count) as unique_std
| eval upperBound_unique=(1+unique_avg+unique_std*3) ``` adjust formula for sensitivity```
| eval isOutlier=CASE(unique_count > upperBound_unique, 1, true(), 0)
| where isOutlier==1
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`