[New Rule] Active Directory Forced Authentication from Linux Host #3912
Conversation
w0rk3r
added
Rule: New
w0rk3r
requested review from
brokensound77,
DefSecSentinel,
Samirbous,
Aegrah and
terrancedejesus
Rule: New - GuidelinesThese guidelines serve as a reminder set of considerations when proposing a new rule. Documentation and Context
Rule Metadata Checks
New BBR Rules
Testing and Validation
|
| "https://www.thehacker.recipes/a-d/movement/mitm-and-coerced-authentications/ms-efsr", | ||
| "https://www.thehacker.recipes/a-d/movement/mitm-and-coerced-authentications/ms-rprn", | ||
| "https://www.thehacker.recipes/a-d/movement/mitm-and-coerced-authentications/ms-dfsnm", |
There was a problem hiding this comment.
Tested with:
petitpotam -> MS-EFSR
printerbug -> MS-RPRN
DFSCoerce -> MS-DFSNM
| type = "eql" | ||
|
|
||
| query = ''' | ||
| sequence with maxspan=15s |
There was a problem hiding this comment.
Works with maxspan=1s in my env, but I'm giving it a bit more here as larger envs may have delays
w0rk3r
changed the title
| index = ["logs-endpoint.events.network-*", "logs-system.security-*"] | ||
| language = "eql" | ||
| license = "Elastic License v2" | ||
| name = "Active Directory Forced Authentication from Linux Host" |
There was a problem hiding this comment.
| name = "Active Directory Forced Authentication from Linux Host" | |
| name = "SMB Authentication from a Linux Host" |
There was a problem hiding this comment.
Not sure if this explains better what it tries to detect
There was a problem hiding this comment.
forced auth means we have evidence that the DC is connecting back to the linux box, so maybe inverting the sequence (auth from window followed by incoming netcon to linux) ?
| [authentication where host.os.type == "windows" and event.action == "logged-in" and | ||
| winlog.event_data.AuthenticationPackageName : "NTLM" and winlog.event_data.SubjectUserSid == "S-1-0-0"] by source.ip |
There was a problem hiding this comment.
maybe you want to limit to host.name containing *DC* to be sure its a domain controller or by host.os.full : "windows server*" to limit to servers.
There was a problem hiding this comment.
You may also want to consider mitm6 relay attacks (just another detection idea)
https://github.com/dirkjanm/mitm6?tab=readme-ov-file
with ntlmrelayx from impacket (https://github.com/fortra/impacket)
| [network where host.os.type == "linux" and event.action == "connection_attempted" and destination.port == 445] by host.ip | ||
| [authentication where host.os.type == "windows" and event.action == "logged-in" and | ||
| winlog.event_data.AuthenticationPackageName : "NTLM" and winlog.event_data.SubjectUserSid == "S-1-0-0"] by source.ip |
There was a problem hiding this comment.
| [network where host.os.type == "linux" and event.action == "connection_attempted" and destination.port == 445] by host.ip | |
| [authentication where host.os.type == "windows" and event.action == "logged-in" and | |
| winlog.event_data.AuthenticationPackageName : "NTLM" and winlog.event_data.SubjectUserSid == "S-1-0-0"] by source.ip | |
| [network where host.os.type == "linux" and event.action == "connection_attempted" and destination.port == 445 | |
| and (destination.ip != null or destination.ip != "0.0.0.0" or cidrmatch ( | |
| destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29", | |
| "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", | |
| "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", | |
| "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10", | |
| "FF00::/8", "172.31.0.0/16" | |
| ) | |
| )] by host.ip | |
| [authentication where host.os.type == "windows" and event.action == "logged-in" and | |
| winlog.event_data.AuthenticationPackageName : "NTLM" and winlog.event_data.SubjectUserSid == "S-1-0-0"] by source.ip |
There was a problem hiding this comment.
You may want to limit to private IPs and exclude loopback.
| [[rule.threat]] | ||
| framework = "MITRE ATT&CK" | ||
| [[rule.threat.technique]] |
There was a problem hiding this comment.
May want to add https://attack.mitre.org/techniques/T1557/
|
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. |
|
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. |
|
This has been closed due to inactivity. If you feel this is an error, please re-open and include a justifying comment. |
Issues
Part of #3544
Summary
Uses both Linux and windows logs to identify a potential forced authentication. Attackers may attempt to force targets to authenticate to a Linux machine controlled by them to capture hashes or to enable relay attacks.
Data
Events/Sample Data