ID | Technique | Tactic |
---|---|---|
T1110 | Brute Force | Credential Access |
T1110.003 | Password Spraying | Credential Access |
Detection: Windows Unusual NTLM Authentication Users By Source
Description
The following analytic detects when an unusual number of NTLM authentications is attempted by the same source. This activity generally results when an attacker attempts to brute force, password spray, or otherwise authenticate to a domain joined Windows device using an NTLM based process/attack. This same activity may also generate a large number of EventID 4776 events in as well.
Search
1`ntlm_audit` EventCode = 8004 SChannelName=* WorkstationName=*
2| eval src = replace(WorkstationName,"\\\\","") ```CIM alignment, remove leading \\ from some auth attempts ```
3| eval dest = SChannelName, user = UserName ``` CIM alignment```
4| where SChannelName!=src ``` Remove NTLM auths to self, improves accuracy for certain applications ```
5| `windows_unusual_ntlm_authentication_users_by_source_filter`
6| stats count min(_time) as firstTime max(_time) as lastTime dc(eval(upper(user))) as unique_count by src
7| eventstats avg(unique_count) as unique_avg , stdev(unique_count) as unique_std
8| eval upperBound_unique=(1+unique_avg+unique_std*3) ``` adjust formula for sensitivity```
9| eval isOutlier=CASE(unique_count > upperBound_unique, 1, true(), 0)
10| where isOutlier==1
11| `security_content_ctime(firstTime)`
12| `security_content_ctime(lastTime)`
Data Source
Name | Platform | Sourcetype | Source | Supported App |
---|---|---|---|---|
N/A | N/A | N/A | N/A | N/A |
Macros Used
Name | Value |
---|---|
ntlm_audit | sourcetype=XmlWinEventLog:Microsoft-Windows-NTLM/Operational OR source=XmlWinEventLog:Microsoft-Windows-NTLM/Operational |
windows_unusual_ntlm_authentication_users_by_source_filter | search * |
windows_unusual_ntlm_authentication_users_by_source_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Risk Event | True |
Implementation
The following analytic requires that NTLM Operational logs to be imported from the environment Domain Controllers. This requires configuration of specific auditing settings, see Microsoft references for further guidance. This analytic is specific to EventID 8004~8006.
Known False Positives
Vulnerability scanners, print servers, and applications that deal with non-domain joined authentications. Recommend adjusting the upperBound_unique eval for tailoring the correlation to your environment, running with a 24hr search window will smooth out some statistical noise.
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
The device [$src$] attempted $count$ NTLM authentications using $unique_count$ user accounts. | 25 | 25 | 100 |
References
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | XmlWinEventLog:Microsoft-Windows-NTLM/Operational |
XmlWinEventLog |
Integration | ✅ Passing | Dataset | XmlWinEventLog:Microsoft-Windows-NTLM/Operational |
XmlWinEventLog |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 1