SigmaHQ/rules/windows/builtin/win_susp_samr_pwset.yml

title: Possible Remote Password Change Through SAMR
id: 7818b381-5eb1-4641-bea5-ef9e4cfb5951
description: Detects a possible remote NTLM hash change through SAMR API SamiChangePasswordUser() or SamSetInformationUser(). "Audit User Account Management" in "Advanced
    Audit Policy Configuration" has to be enabled in your local security policy / GPO to see this events.
author: Dimitrios Slamaris
date: 2017/06/09
tags:
    - attack.credential_access
    - attack.t1212
logsource:
    product: windows
    service: security
detection:
    samrpipe:
        EventID: 5145
        RelativeTargetName: samr
    passwordchanged:
        EventID: 4738
    passwordchanged_filter:
        PasswordLastSet: null
    timeframe: 15s
    condition: ( passwordchanged and not passwordchanged_filter ) | near samrpipe
level: medium
Added UUIDs to rules 2019-11-12 22:12:27 +00:00			`title: Possible Remote Password Change Through SAMR`
			`id: 7818b381-5eb1-4641-bea5-ef9e4cfb5951`
			`description: Detects a possible remote NTLM hash change through SAMR API SamiChangePasswordUser() or SamSetInformationUser(). "Audit User Account Management" in "Advanced`
			`Audit Policy Configuration" has to be enabled in your local security policy / GPO to see this events.`
rule to detect mimikatz lsadump::changentlm and lsadump::setntlm 2017-06-09 12:05:40 +00:00			`author: Dimitrios Slamaris`
fix: fixed missing date fields in remaining files 2020-01-30 15:07:37 +00:00			`date: 2017/06/09`
Add tags to windows builtin rules 2018-07-24 05:50:32 +00:00			`tags:`
			`- attack.credential_access`
			`- attack.t1212`
rule to detect mimikatz lsadump::changentlm and lsadump::setntlm 2017-06-09 12:05:40 +00:00			`logsource:`
			`product: windows`
			`service: security`
			`detection:`
			`samrpipe:`
Adjusted rules to the new specs reg "not null" usage 2018-06-28 07:30:12 +00:00			`EventID: 5145`
			`RelativeTargetName: samr`
rule to detect mimikatz lsadump::changentlm and lsadump::setntlm 2017-06-09 12:05:40 +00:00			`passwordchanged:`
Adjusted rules to the new specs reg "not null" usage 2018-06-28 07:30:12 +00:00			`EventID: 4738`
			`passwordchanged_filter:`
			`PasswordLastSet: null`
fix: fixed missing date fields in remaining files 2020-01-30 15:07:37 +00:00			`timeframe: 15s`
Trying to fix rule 2018-06-28 14:39:13 +00:00			`condition: ( passwordchanged and not passwordchanged_filter ) \| near samrpipe`
rule to detect mimikatz lsadump::changentlm and lsadump::setntlm 2017-06-09 12:05:40 +00:00			`level: medium`