Detection: Windows Unusual NTLM Authentication Destinations By Source

Description

The following analytic detects when an unusual number NTLM authentications is attempted by the same source against multiple destinations. This activity generally results when an attacker attempts to brute force, password spray, or otherwise authenticate to a multiple domain joined Windows devices using an NTLM based process/attack. This same activity may also generate a large number of EventID 4776 events as well.

 1`ntlm_audit` EventCode = 8004 SChannelName=* WorkstationName=* 
 2| eval src = replace(WorkstationName,"\\\\","")  ```CIM alignment, remove leading \\ from some auth attempts ``` 
 3| eval dest = SChannelName, user = UserName ``` CIM alignment``` 
 4| where SChannelName!=src ``` Remove NTLM auths to self, improves accuracy for certain applications ``` 
 5| `windows_unusual_ntlm_authentication_destinations_by_source_filter` 
 6| stats count min(_time) as firstTime max(_time) as lastTime dc(eval(upper(dest))) as unique_count by src 
 7| eventstats avg(unique_count) as unique_avg , stdev(unique_count) as unique_std 
 8| eval upperBound_unique=(1+unique_avg+unique_std*3) ``` adjust formula for sensitivity``` 
 9| eval isOutlier=CASE(unique_count > upperBound_unique, 1, true(), 0) 
10| where isOutlier==1 
11| `security_content_ctime(firstTime)` 
12| `security_content_ctime(lastTime)`

Data Source

Name Platform Sourcetype Source Supported App
N/A N/A N/A N/A N/A

Macros Used

Name Value
ntlm_audit sourcetype=XmlWinEventLog:Microsoft-Windows-NTLM/Operational OR source=XmlWinEventLog:Microsoft-Windows-NTLM/Operational
windows_unusual_ntlm_authentication_destinations_by_source_filter search *
windows_unusual_ntlm_authentication_destinations_by_source_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1110 Brute Force Credential Access
T1110.003 Password Spraying Credential Access
KillChainPhase.EXPLOITAITON
NistCategory.DE_AE
Cis18Value.CIS_10
APT28
APT38
APT39
DarkVishnya
Dragonfly
FIN5
Fox Kitten
HEXANE
OilRig
Turla
APT28
APT29
APT33
Chimera
HEXANE
Lazarus Group
Leafminer
Silent Librarian

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Risk Event True
This configuration file applies to all detections of type anomaly. These detections will use Risk Based Alerting.

Implementation

The following analytic requires that NTLM Operational logs to be imported from the environment Domain Controllers. This requires configuration of specific auditing settings, see Microsoft references for further guidance. This analytic is specific to EventID 8004~8006.

Known False Positives

Vulnerability scanners, print servers, and applications that deal with non-domain joined authentications. Recommend adjusting the upperBound_unique eval for tailoring the correlation to your environment, running with a 24hr search window will smooth out some statistical noise.

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message Risk Score Impact Confidence
The device [$src$] attempted $count$ NTLM authentications against $unique_count$ destinations. 25 25 100
The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

References

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation Passing N/A N/A N/A
Unit Passing Dataset XmlWinEventLog:Microsoft-Windows-NTLM/Operational XmlWinEventLog
Integration ✅ Passing Dataset XmlWinEventLog:Microsoft-Windows-NTLM/Operational XmlWinEventLog

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range


Source: GitHub | Version: 1