Name:Windows Unusual NTLM Authentication Destinations By User id:a4d86702-402b-4a4f-8d06-9d61e6c39cad version:2 date:2024-09-30 author:Steven Dick status:production type:Anomaly Description:The following analytic detects when an unusual number of NTLM authentications is attempted by the same user account against multiple destinations. This activity generally results when an attacker attempts to brute force, password spray, or otherwise authenticate to numerous domain joined Windows devices using an NTLM based process/attack. This same activity may also generate a large number of EventID 4776 events as well. Data_source:
-NTLM Operational 8004,8005,8006
search:`ntlm_audit` EventCode = 8004 SChannelName=* WorkstationName=* | eval src = replace(WorkstationName,"\\\\","") ```CIM alignment, remove leading \\ from some auth attempts ``` | eval dest = SChannelName, user = UserName ``` CIM alignment``` | where SChannelName!=src ``` Remove NTLM auths to self, improves accuracy for certain applications ``` | `windows_unusual_ntlm_authentication_destinations_by_user_filter` | stats count min(_time) as firstTime max(_time) as lastTime dc(eval(upper(dest))) as unique_count by user | eventstats avg(unique_count) as unique_avg , stdev(unique_count) as unique_std | eval upperBound_unique=(1+unique_avg+unique_std*3) ``` adjust formula for sensitivity``` | eval isOutlier=CASE(unique_count > upperBound_unique, 1, true(), 0) | where isOutlier==1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
how_to_implement:The following analytic requires that NTLM Operational logs to be imported from the environment Domain Controllers. This requires configuration of specific auditing settings, see Microsoft references for further guidance. This analytic is specific to EventID 8004~8006. known_false_positives:Vulnerability scanners, print servers, and applications that deal with non-domain joined authentications. Recommend adjusting the upperBound_unique eval for tailoring the correlation to your environment, running with a 24hr search window will smooth out some statistical noise. References: -https://attack.mitre.org/techniques/T1110/003/ -https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/ntlm-blocking-and-you-application-analysis-and-auditing/ba-p/397191 -https://techcommunity.microsoft.com/t5/microsoft-defender-for-identity/enriched-ntlm-authentication-data-using-windows-event-8004/m-p/871827 -https://www.varonis.com/blog/investigate-ntlm-brute-force -https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nrpc/4d1235e3-2c96-4e9f-a147-3cb338a0d09f drilldown_searches: name:'View the detection results for - "$user$"' search:'%original_detection_search% | search user = "$user$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$user$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' tags: analytic_story: - 'Active Directory Password Spraying' asset_type:Endpoint confidence:100 impact:25 message:The user [$user$] attempted $count$ NTLM authentications against $unique_count$ destinations. mitre_attack_id: - 'T1110' - 'T1110.003' observable: name:'user' type:'User' - role: - 'Victim' product: - 'Splunk Enterprise' - 'Splunk Enterprise Security' - 'Splunk Cloud' required_fields: - '_time' - 'EventCode' - 'DomainName' - 'Security' - 'WorkstationName' risk_score:25 security_domain:endpoint
