SigmaHQ/rules/windows/builtin/win_susp_samr_pwset.yml

title: Possible Remote Password Change Through SAMR 
description: Detects a possible remote NTLM hash change through SAMR API SamiChangePasswordUser() or SamSetInformationUser(). "Audit User Account Management" in "Advanced Audit Policy Configuration" has to be enabled in your local security policy / GPO to see this events.
author: Dimitrios Slamaris
logsource:
    product: windows
    service: security
detection:
    samrpipe:
        EventID: 5145
        RelativeTargetName: samr
    passwordchanged:
        EventID: 4738
    passwordchanged_filter:
        PasswordLastSet: null
    timeframe: 15s 
    condition: ( passwordchanged and not passwordchanged_filter ) | near samrpipe
level: medium
Massive Title Cleanup 2018-01-27 09:57:30 +00:00			`title: Possible Remote Password Change Through SAMR`
clarification: if executed locally there is no connection to the samr pipe on IPC$. So this rule detects remote changes 2017-06-09 12:15:37 +00:00			`description: Detects a possible remote NTLM hash change through SAMR API SamiChangePasswordUser() or SamSetInformationUser(). "Audit User Account Management" in "Advanced Audit Policy Configuration" has to be enabled in your local security policy / GPO to see this events.`
rule to detect mimikatz lsadump::changentlm and lsadump::setntlm 2017-06-09 12:05:40 +00:00			`author: Dimitrios Slamaris`
			`logsource:`
			`product: windows`
			`service: security`
			`detection:`
			`samrpipe:`
Adjusted rules to the new specs reg "not null" usage 2018-06-28 07:30:12 +00:00			`EventID: 5145`
			`RelativeTargetName: samr`
rule to detect mimikatz lsadump::changentlm and lsadump::setntlm 2017-06-09 12:05:40 +00:00			`passwordchanged:`
Adjusted rules to the new specs reg "not null" usage 2018-06-28 07:30:12 +00:00			`EventID: 4738`
			`passwordchanged_filter:`
			`PasswordLastSet: null`
rule to detect mimikatz lsadump::changentlm and lsadump::setntlm 2017-06-09 12:05:40 +00:00			`timeframe: 15s`
Trying to fix rule 2018-06-28 14:39:13 +00:00			`condition: ( passwordchanged and not passwordchanged_filter ) \| near samrpipe`
rule to detect mimikatz lsadump::changentlm and lsadump::setntlm 2017-06-09 12:05:40 +00:00			`level: medium`