Elastic high stable eql

Potential Machine Account Relay Attack via SMB

Identifies potential relay attacks against a machine account by identifying network share access events coming from a remote source.ip but using the target server computer account. This may indicate an SMB relay attack.

View Source

Detection Logic

file where host.os.type == "windows" and event.code == "5145" and endswith(user.name, "$") and

 /* compare computername with user.name and make sure they match (dot-boundary prevents prefix-only matches) */
 startswith~(concat(winlog.computer_name, "."), concat(substring(user.name, 0, -1), ".")) and

 /* exclude local access */
 not endswith(string(source.ip), string(host.ip)) and
 source.ip != "::" and source.ip != null and source.ip != "::1" and source.ip != "127.0.0.1"

Field Validations

Loading…

Comments (0)

Loading comments...