Possible PetitPotam Coerce Authentication Attempt

Title: Possible PetitPotam Coerce Authentication Attempt
Status: test
Description:Detect PetitPotam coerced authentication activity.
References:
  -https://github.com/topotam/PetitPotam
  -https://github.com/splunk/security_content/blob/0dd6de32de2118b2818550df9e65255f4109a56d/detections/endpoint/petitpotam_network_share_access_request.yml
Author: Mauricio Velazco, Michael Haag
Date: 2021-09-02
modified:2022-08-11
Tags:

• -'attack.credential-access'
• -'attack.t1187'

Logsource:

• product: windows
• service: security
• definition: The advanced audit policy setting "Object Access > Detailed File Share" must be configured for Success/Failure

Detection:
  selection:
    EventID: '5145'
    ShareName|startswith: '\\\\'
    ShareName|endswith: '\IPC$'
    RelativeTargetName: 'lsarpc'
    SubjectUserName: 'ANONYMOUS LOGON'
  condition:selection
Falsepositives:
  -Unknown. Feedback welcomed.
Level: high