Windows: Potential Pass the Hash Attack

Rule ID

PH_RULE_Win_PassTheHash

Default Status

Enabled

Description

This rule detects a sequence of Windows authentication events indicative of potential Pass-the-Hash activity. It identifies a NewCredentials logon (Event ID 4624, Logon Type 9 using seclogo), which may indicate alternate credential staging, followed by a network logon (Event ID 4624, Logon Type 3 using NTLM via NtLmSsp) within a short time window, from this host to another host. This pattern is commonly associated with lateral movement techniques where stolen credential material (such as NTLM hashes) is reused to authenticate to remote systems without the original password.

Severity

9High

Category

Security

Detection Technology

Correlation

Rule Mode

Streaming

MITRE ATT&CK® Tactics

Defense Evasion

Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses.

MITRE ATT&CK® Techniques

T1550.002

Use Alternate Authentication Material: Pass the Hash

Adversaries may "Pass the hash" using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. Valid password hashes for an account are captured using a Credential Access technique and can be used with PtH to authenticate as that user. Once authenticated, PtH may be used to perform actions on local or remote systems.

Impacts

Server

Data Source

Microsoft Windows Security Log via OMI or FortiSIEM Agent

Detection

Correlation

Remediation Guidance

Investigate the source host and user context to confirm whether the activity is legitimate administrative behavior or unauthorized credential use. Validate the origin of the logon, review associated process and network activity, and check for additional lateral movement or credential access indicators. If suspicious, isolate the affected system, reset compromised credentials, and review privileged account usage. Strengthen defenses by enabling Credential Guard, minimizing NTLM usage, enforcing unique local administrator passwords (e.g., via LAPS), and restricting or auditing NTLM authentication across the environment.

Time Window

If the following pattern or patterns match an ingested event within the given time window in seconds, trigger an incident.

300 seconds

Trigger Conditions

If the following defined pattern/s occur within a 300 second time window.

sus_newcreds_logon AND pth

Global Constraint

This defines how two or more distinct events are related in a time-series based action. e.g. An event occurs followed by another event if the source IP, user, and messageId are the same

sus_newcreds_logon.reptDevIpAddr=pth.srcIpAddr AND sus_newcreds_logon.user=pth.user

SubPattern Definitions

eventType="Win-Security-4624" AND winLogonType=9 AND winLogonProc="seclogo" AND securityId REGEXP "S-1-12-1-.*|S-1-5-21-.*"

reptDevName,reptDevIpAddr,user

COUNT(*)>=1

Operator Rank: 0 Operator Type: AND

eventType="Win-Security-4624" AND winLogonType=3 AND winLogonProc="NtLmSsp"

srcIpAddr,hostName,user

COUNT(*)>=1

Incident Attribute Mapping

This section defines which fields in matching raw events should be mapped to the incident attributes in the resulting incident.

The available raw event attributes to map are limited to the group by attributes and the aggregate event constraint fields for each subpattern

hostName = sus_newcreds_logon.reptDevName,
 hostIpAddr = sus_newcreds_logon.reptDevIpAddr,
 user = sus_newcreds_logon.user,
destName = pth.hostName