valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 01:45:21 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #36 from dim0x69/master

Browse Source 
rule to detect mimikatz lsadump::changentlm and lsadump::setntlm
This commit is contained in:
Thomas Patzke 2017-06-19 15:32:56 +02:00 committed by GitHub
commit 7fdc78c8bf
1 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
rules/windows/builtin/win_susp_samr_pwset.yml Normal file
View File

@ -0,0 +1,18 @@
title: Possible remote password change (NTLM hash only) through SAMR
description: Detects a possible remote NTLM hash change through SAMR API SamiChangePasswordUser() or SamSetInformationUser(). "Audit User Account Management" in "Advanced Audit Policy Configuration" has to be enabled in your local security policy / GPO to see this events.
author: Dimitrios Slamaris
logsource:
product: windows
service: security
detection:
samrpipe:
- EventLog: Security
EventID: 5145
RelativeTargetName: samr
passwordchanged:
- EventLog: Security
EventID: 4738
PasswordLastSet: (any)
timeframe: 15s
condition: samrpipe | near passwordchanged within timeframe
level: medium