Elastic medium stable eql

Potential Computer Account NTLM Relay Activity

Identifies potential relay activities against a Computer account by identifying authentication events using the computer account coming from from hosts other than the server that owns the account. Attackers may relay the computer account hash after capturing it using forced authentication.

View Source

Detection Logic

authentication where host.os.type == "windows" and event.code in ("4624", "4625") and
 winlog.logon.type == "Network" and winlog.event_data.AuthenticationPackageName == "NTLM" and
 endswith~(user.name, "$") and user.name != "$" and
 source.ip != null and source.ip != "::1" and source.ip != "127.0.0.1" and

 /* Filter for a machine account that matches the hostname */
 startswith~(host.name, substring(user.name, 0, -1)) and

 /* Verify the machine account matches the full hostname, not just a prefix substring */
 (startswith~(substring(user.name, 0, -1), host.name) or startswith~(host.name, concat(substring(user.name, 0, -1), "."))) and

 /* Verify if the Source IP belongs to the host */
 not endswith(string(source.ip), string(host.ip)) and
 indexOf(string(host.ip), string(source.ip)) == null and

 /* Exclude self-authentication from multi-homed hosts where the NTLM workstation name matches the machine account */
 not (source.domain != null and
      startswith~(user.name, source.domain) and
      startswith~(source.domain, substring(user.name, 0, -1)))

Field Validations

Loading…

Comments (0)

Loading comments...