Pass the Hash Activity 2

Title: Pass the Hash Activity 2
Status: stable
Description:Detects the attack technique pass the hash which is used to move laterally inside the network
References:
  -https://github.com/iadgov/Event-Forwarding-Guidance/tree/master/Events
  -https://web.archive.org/web/20170909091934/https://blog.binarydefense.com/reliably-detecting-pass-the-hash-through-event-log-analysis
  -https://blog.stealthbits.com/how-to-detect-pass-the-hash-attacks/
Author: Dave Kennedy, Jeff Warren (method) / David Vassallo (rule)
Date: 2019-06-14
modified:2022-10-05
Tags:

• -'attack.lateral-movement'
• -'attack.t1550.002'

Logsource:

• product: windows
• service: security
• definition: The successful use of PtH for lateral movement between workstations would trigger event ID 4624

Detection:
  selection_logon3:
    EventID: '4624'
    SubjectUserSid: 'S-1-0-0'
    LogonType: '3'
    LogonProcessName: 'NtLmSsp'
    KeyLength: '0'
  selection_logon9:
    EventID: '4624'
    LogonType: '9'
    LogonProcessName: 'seclogo'
  filter:
    TargetUserName: 'ANONYMOUS LOGON'
  condition:1 of selection_* and not filter
Falsepositives:
  -Administrator activity
Level: medium