Situational AwarenessCAR-2016-04-004

Successful Local Account Login

Hypothesis and description

The successful use of Pass The Hash for lateral movement between workstations would trigger event ID 4624, with an event level of Information, from the security log. This behavior would be a LogonType of 3 using NTLM authentication where it is not a domain logon and not the ANONYMOUS LOGON account.

Platforms: Windows
Domain: Host
Subtypes: Login
Submitted: 2016-04-18
Contributors: MITRE/NSA

ATT&CK coverage

Technique	Tactics	Coverage
T1550 Use Alternate Authentication MaterialT1550.002	Lateral Movement	Moderate

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1550Use Alternate Authentication Material
.002 Pass the Hash

D3FEND techniques MITRE maps to this analytic

D3-LAM Local Account Monitoring

Pseudocode and implementations

Pseudocode

This analytic will look for remote logins, using a non domain login, from one host to another, using NTL authentication where the account is not "ANONYMOUS LOGON".

EventCode == 4624 and [target_user_name] != "ANONYMOUS LOGON" and
[authentication_package_name] == "NTLM"

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

20 more in the full list

View CAR-2016-04-004 on car.mitre.org