How to Detect a Pass-the-Hash (PtH) Attack Using Logs
Pass-the-Hash (PtH) attacks exploit stolen NTLM hashes to authenticate without requiring a user’s plaintext password. Detecting PtH attacks involves monitoring authentication activity and correlating logs across systems for unusual patterns.
1. Monitor NTLM Authentication Requests
What to Look For:
NTLM Validation Attempts:
Event ID 4776: Logs attempts by a computer to validate credentials using NTLM.
Patterns of Abuse:
Repeated NTLM authentication requests that deviate from normal user behavior.
Red Flags: Authentication attempts using NTLM hashes instead of passwords, often associated with lateral movement.
2. Check for Authentication from Unusual Sources
What to Look For:
Logins from Unexpected Locations:
Event ID 4624: Captures successful logons. Look for:
Logins originating from machines that the user does not typically use.
New devices or IPs accessing privileged accounts.
Logon Types:
Logon Type 3 (Network Logon): Common in PtH attacks for network-based authentication.
Red Flags: Logins to critical systems from unauthorized devices or accounts.
3. Investigate Account Activity Across Multiple Systems
What to Do:
Correlate Logon Events:
Review logs for the same account logging into multiple machines within a short time frame.
Monitor patterns that suggest lateral movement, such as a user account being used sequentially on different hosts.
Key Event IDs:
4624 (Successful Logon): Indicates account usage across systems.
4648 (Explicit Credential Use): Captures credential use on remote systems.
Red Flags: Rapid logins across several systems, especially by privileged accounts.
4. Examine Logs for High-Privilege Accounts
What to Focus On:
Administrative Activity:
Monitor accounts with elevated privileges, as attackers often target administrative credentials.
Unusual Use of Privileged Accounts:
Accounts being used for unexpected logins or accessing sensitive resources.
Red Flags: High-privilege accounts being used from machines or locations not associated with the account owner.
5. Analyze SMB Traffic
What to Look For:
Unusual SMB Connections:
PtH attacks often involve SMB (Server Message Block) to authenticate with stolen hashes and access resources.
Patterns in Network Logs:
Sudden increases in SMB traffic or connections between systems not typically interacting.
Analysis Tip: Correlate SMB activity with Event IDs 4624 and 4776 to confirm authentication attempts via NTLM.
6. Cross-Reference with Event ID 4625
What to Look For:
Failed Login Attempts:
Event ID 4625: Logs failed authentication attempts. Look for:
Failure reasons indicating invalid credentials.
Repeated failed logins followed by a successful logon, which may indicate the attacker is testing stolen hashes.
Patterns in Failures:
Multiple failures from the same source or targeting the same account.
Red Flags: Failed logins with specific failure reasons related to invalid NTLM hashes.
7. Immediate Mitigation
What to Do:
Isolate Affected Systems: Disconnect compromised machines from the network to prevent further lateral movement.
Reset Credentials: Immediately reset passwords for accounts involved in the attack, especially privileged accounts.
Review Compromised Accounts: Check for additional accounts that may have been accessed using stolen hashes.
Limit NTLM Usage:
Implement security measures such as enforcing Kerberos authentication.
Disable NTLM where possible or limit its use to specific systems.
Long-Term Measures:
Deploy Enhanced Security Tools: Use tools like Microsoft LAPS (Local Administrator Password Solution) to manage local admin passwords securely.
Enable Credential Guard: Protect against hash extraction by isolating LSASS memory.
Harden Network Access: Enforce least-privilege principles, segment networks, and monitor for lateral movement.
Conclusion
Detecting Pass-the-Hash attacks requires monitoring authentication logs, analyzing access patterns, and correlating activity across systems. Early detection combined with immediate mitigation can prevent attackers from leveraging stolen hashes for further compromise.
Last updated