PTH_2.yaml

detect:
 event: WEL
op: or
rules:
  - op: is
    path: Event/System/EventID
    value: '4648'
    with child:
      op: and
      rules:
        - op: is
          path: Event/System/EventID
          value: '4624'
        - op: is
          path: Event/EventData/LogonType
          value: '9'
        - op: is
          path: Event/EventData/LogonProcessName
          value: seclogo
      with child:
        op: is
        path: Event/System/EventID
        value: '4672'
  - op: and
    rules:
      - op: is
        path: Event/System/EventID
        value: '4624'
      - op: is
        path: Event/EventData/LogonType
        value: '3'
      - op: is
        path: event/EVENT/EventData/authenticationpackagename
        value: NTLM
        with child:
          op: is
          path: Event/System/EventID
          value: '4672'
  - op: is
    path: Event/System/EventID
    value: '4776'
  - case sensitive: false
    op: contains
    path: event/COMMAND_LINE
    value: crackmapexec
  - case sensitive: false
    op: contains
    path: event/COMMAND_LINE
    value: impacket-psexec -hashes
respond:
- action: report
  metadata:
    author: Sawood(TAGTREX), Shehroz(TAGTREX)
    description: Detecting PTH using system telemtry
    falsepositives:
    - Administrator activity
    level: High
    tags:
    - attack.lateral_movement
    - attack.t1550.002
  name: Pass The Hash Detected