Windows Multiple NTLM Null Domain Authentications

Try in Splunk Security Cloud

Description

The following analytic detects when a device is the target of numerous NTLM authentications using a null domain. This activity generally results when an attacker attempts to brute force, password spray, or otherwise authenticate to a domain joined Windows device from a non-domain device. This activity may also generate a large number of EventID 4776 events in tandem, however these events will not indicate the attacker or target device

• Type: TTP

• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud

• Last Updated: 2024-03-16
• Author: Steven Dick
• ID: c187ce2c-c88e-4cec-8a1c-607ca0dedd78

Annotations

ATT&CK

ATT&CK

ID	Technique	Tactic
T1110	Brute Force	Credential Access

T1110.003

Password Spraying

Credential Access

Kill Chain Phase

• Exploitation

NIST

• DE.CM

CIS20

• CIS 10

CVE

Search

`ntlm_audit` EventCode IN (8004,8005,8006) DomainName=NULL UserName!=NULL 
| eval src = replace(WorkstationName,"\\\\","")  ```CIM alignment, remove leading \\ from some auth attempts ``` 
| eval dest = SChannelName, user = UserName ``` CIM alignment``` 
| where SChannelName!=src ``` Remove NTLM auths to self, improves accuracy for certain applications``` 
| `windows_multiple_ntlm_null_domain_authentications_filter` 
| stats count min(_time) as firstTime max(_time) as lastTime dc(eval(upper(user))) as unique_count dc(eval(upper(src))) as src_count by dest 
| eventstats avg(unique_count) as unique_avg , stdev(unique_count) as unique_std 
| eval upperBound_unique=(1+unique_avg+unique_std*3) ``` adjust formula for sensitivity``` 
| eval isOutlier=CASE(unique_count > upperBound_unique, 1, true(), 0) 
| where isOutlier==1 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)`

Macros

The SPL above uses the following Macros:

• ntlm_audit
• security_content_ctime

windows_multiple_ntlm_null_domain_authentications_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

• _time
• EventCode
• DomainName
• Security
• WorkstationName

How To Implement

The following analytic requires that NTLM Operational logs to be imported from the environment Domain Controllers. This requires configuration of specific auditing settings, see Microsoft references for further guidance. This analytic is specific to EventID 8004~8006.

Known False Positives

Applications that deal with non-domain joined authentications. Recommend adjusting the upperBound_unique eval for tailoring the correlation to your environment, running with a 24hr search window will smooth out some statistical noise.

Associated Analytic Story

• Active Directory Password Spraying

RBA

Risk Score	Impact	Confidence	Message
75.0	75	100	The device [$dest$] was the target of $count$ NTLM authentications from $src_count$ sources using $unique_count$ unique user accounts.

The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

• https://attack.mitre.org/techniques/T1110/003/
• https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/ntlm-blocking-and-you-application-analysis-and-auditing/ba-p/397191
• https://techcommunity.microsoft.com/t5/microsoft-defender-for-identity/enriched-ntlm-authentication-data-using-windows-event-8004/m-p/871827
• https://www.varonis.com/blog/investigate-ntlm-brute-force
• https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nrpc/4d1235e3-2c96-4e9f-a147-3cb338a0d09f

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1