
title: Successful Overpass the Hash Attempt
author: Roberto Rodriguez (source), Dominik Schaudel (rule)
date: 2018/02/12
description: Detects successful logon with logon type 9 (NewCredentials) which matches
  the Overpass the Hash behavior of e.g Mimikatz's sekurlsa::pth module.
detection:
  SELECTION_1:
    EventID: 4624
  SELECTION_2:
    LogonType: 9
  SELECTION_3:
    LogonProcessName: seclogo
  SELECTION_4:
    AuthenticationPackageName: Negotiate
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3 and SELECTION_4)
falsepositives:
- Runas command-line tool using /netonly parameter
id: 192a0330-c20b-4356-90b6-7b7049ae0b87
level: high
logsource:
  product: windows
  service: security
references:
- https://cyberwardog.blogspot.de/2017/04/chronicles-of-threat-hunter-hunting-for.html
status: experimental
tags:
- attack.lateral_movement
- attack.t1075
- attack.s0002
- attack.t1550.002
ruletype: SIGMA
