Windows Multiple NTLM Null Domain Authentications

Name:Windows Multiple NTLM Null Domain Authentications
id:c187ce2c-c88e-4cec-8a1c-607ca0dedd78
version:10
date:None
author:Steven Dick
status:production
type:TTP
Description:The following analytic detects when a device is the target of numerous NTLM authentications using a null domain. This activity generally results when an attacker attempts to brute force, password spray, or otherwise authenticate to a domain joined Windows device from a non-domain device. This activity may also generate a large number of EventID 4776 events in tandem, however these events will not indicate the attacker or target device
Data_source:

• -NTLM Operational 8004
• -NTLM Operational 8005
• -NTLM Operational 8006

search:`ntlm_audit` EventCode IN (8004,8005,8006) DomainName=NULL UserName!=NULL
| eval src = replace(WorkstationName,"\\\\","") ```CIM alignment, remove leading \\ from some auth attempts ```
| eval dest = SChannelName, user = UserName ``` CIM alignment```
| where SChannelName!=src ``` Remove NTLM auths to self, improves accuracy for certain applications```
| stats count min(_time) as firstTime max(_time) as lastTime dc(eval(upper(user))) as unique_count dc(eval(upper(src))) as src_count by dest
| eventstats avg(unique_count) as unique_avg , stdev(unique_count) as unique_std
| eval upperBound_unique=(1+unique_avg+unique_std*3) ``` adjust formula for sensitivity```
| eval isOutlier=CASE(unique_count > upperBound_unique, 1, true(), 0)
| where isOutlier==1
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_multiple_ntlm_null_domain_authentications_filter`

how_to_implement:The following analytic requires that NTLM Operational logs to be imported from the environment Domain Controllers. This requires configuration of specific auditing settings, see Microsoft references for further guidance. This analytic is specific to EventID 8004~8006.
known_false_positives:Applications that deal with non-domain joined authentications. Recommend adjusting the upperBound_unique eval for tailoring the correlation to your environment, running with a 24hr search window will smooth out some statistical noise.
References:
  -https://attack.mitre.org/techniques/T1110/003/
  -https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/ntlm-blocking-and-you-application-analysis-and-auditing/ba-p/397191
  -https://techcommunity.microsoft.com/t5/microsoft-defender-for-identity/enriched-ntlm-authentication-data-using-windows-event-8004/m-p/871827
  -https://www.varonis.com/blog/investigate-ntlm-brute-force
  -https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nrpc/4d1235e3-2c96-4e9f-a147-3cb338a0d09f
drilldown_searches:
 name:'View the detection results for - "$dest$"'
 search:'%original_detection_search% | search dest = "$dest$"'
 earliest_offset:'$info_min_time$'
 latest_offset:'$info_max_time$'
 name:'View risk events for the last 7 days for - "$dest$"'
 search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
 earliest_offset:'7d'
 latest_offset:'0'
analytic_story:['Active Directory Password Spraying']

asset_type:Endpoint

mitre_attack_id:['T1110.003']

product:['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']

category:endpoint

security_domain:endpoint

tags:

tests:
 name:'True Positive Test'
 attack_data:
  data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/ntlm_bruteforce/ntlm_bruteforce.log
  source: XmlWinEventLog:Microsoft-Windows-NTLM/Operational
  sourcetype: XmlWinEventLog
 test_type:'unit'
manual_test:None