Query: alert when Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz
Matching passage: Sigma rule: Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz. Logsource: windows / security. Rule: title: Successful Overpass the Hash Attempt id: 192a0330-c20b-4356-90b6-7b7049ae0b87 status: test description: Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz's sekurlsa::pth module. references: - https://web.archive.org/web/20220419045003/https://cyberwardog.blogspot.com/2017/04/chronicles-of-threat-hunter-hunting-for.html author: Roberto Rodriguez (source), Dominik Schaudel (rule) date: 2018-02-12 modified: 2021-11-27 tags: - attack.lateral-movement - attack.s0002 - attack.t1550.002 logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: 9 LogonProcessName: seclogo AuthenticationPackageName: Negotiate condition: selection falsepositives: - Runas command-line tool using /netonly parameter level: high
Near-miss passage: Sigma rule: Detects the creation of a named pipe seen used by known APTs or malware.. Logsource: windows / pipe_created. Rule: title: Malicious Named Pipe Created id: fe3ac066-98bb-432a-b1e7-a5229cb39d4a status: test description: Detects the creation of a named pipe seen used by known APTs or malware. references: - https://securelist.com/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/71275/ - https://securelist.com/faq-the-projectsauron-apt/75533/ - https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf - https://www.us-cert.gov/ncas/alerts/TA17-117A - https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html - https://thedfirreport.com/2020/06/21/snatch-ransomware/ - https://github.com/RiccardoAncarani/LiquidSnake - https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity - https://us-cert.cisa.gov/ncas/analysis-reports/ar19-304a - https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf - https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/ - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/ author: Florian Roth (Nextron Systems), blueteam0ps, elhoim date: 2017-11-06 modified: 2023-08-07 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName: - \46a676ab7f179e511e30dd2dc41bd388 - \583da945-62af-10e8-4902-a8f205c72b2e - \6e7645c4-32c5-4fe3-aabf-e94c2f4370e7 - \9f81f59bc58452127884ce513865ed20 - \adschemerpc - \ahexec - \AnonymousPipe - \bc31a7 - \bc367 - \bizkaz - \csexecsvc - \dce_3d - \e710f28d59aa529d6792ca6ff0ca1b34 - \gruntsvc - \isapi_dg - \isapi_dg2 - \isapi_http - \jaccdpqnvbrrxlaf - \lsassw - \NamePipe_MoreWindows - \pcheap_reuse - \Posh* - \rpchlp_3 - \sdlrpc - \svcctl - \testPipe -