Transcript
from Manage Engine to detect Pass-the-Hash activity. Pass-the-Hash is an identity-based attack in which adversaries pose as legitimate users to gain unauthorized access to a network. It is a type of credential theft technique where attackers compromise the hashed values of a user's credentials to create a new user session on the same network. The hashed values are compromised by exploiting the NTLM protocol, which typically allows a user to log in using stored password hashes without requiring the submission of a plain text password. Thus, instead of compromising the actual password, attackers steal the stored version of the password, i.e. the hashed values, to sneak into the network. Additionally, these hashed values remain the same until the user resets the password. Therefore, until and unless a user resets the password, attackers enjoy unlimited access to the network and its resources, aiding lateral movement and privilege escalation. Now let's explore how a Pass-the-Hash attack read out. Initially, attackers gain unauthorized access to the target network via phishing campaigns or by exploiting vulnerabilities. They then utilize hash-dumping tools like Mimikatz to extract user accounts and password hashes. These hashes are generally stored in the Windows Systems Security Accounts Manager, local security authority subsystem process memory, and the NTDS directory database in Active Directory. The attackers exploit the NTLM protocol and use the password hashes to authenticate to other system resources. If the user account has excessive privileges or if the same credentials are used across multiple systems, lateral movement becomes much easier. The attacker hops from one machine to another until they locate an account with higher privileges such as a domain administrator. Finally, after achieving the required privileges, attackers may execute other cyber attacks like ransomware and cause damage to data security and the integrity of the network. Now let's see how a unified SIM solution like Log360 can help in a situation like this. Log360 provides out-of-the-box reports to detect pass-the-hash activity. You can find this under the Reports tab of Event Log Analyzer or the SIM module of Log360. As pass-the-hash is an important technique under the MITRE ATT&CK framework, you can find the report under Defense Evasion under MITRE ATT&CK Reports. You can find pass-the-hash activity report under Use Alternate Authentication Material. Using log analysis and Sysvon analysis, Log360 accurately spots successful authentications that happen without passwords. It gives us a visual representation of the frequency of pass-the-hash activity in the network. It also provides details such as when the event occurred, the IP address of the device involved, the event ID, the severity of the event, the logon type, the process name, and the remote device involved. Log360 also comes with SOAR capabilities. This means that if you associate a response workflow with an alert profile, Log360 will be able to carry out certain automated actions such as terminating a process or service and disabling a device or user. However, to prevent future attacks, here are some steps you can take. Enforce mandatory password resets periodically and follow strong password policies. Review and audit system processes periodically. Identify gaps or weaknesses by reviewing and updating your security policies. Implement MFA, review user privileges, and grant access based on the principle of least privilege. And lastly, invest in employee training and user education to prevent future attacks. If you have any questions or would like to get a personalized demo, please send an email to log360-support at manageengine.com. Thank you for watching this video. If you wish to see Log360 in action, visit this link and download our project. You can also get a free 30-day trial of Log360 and evaluate how it satisfies your requirements.
