NTLM Network Logon Anomalies (Lateral Movement)

Anomalous NTLM Logon Pattern To Multiple Device Groups Lateral Movement Behavior

Query

let Lookback = 30d;
let RecentWindow = 1h;
let whitelistedAccounts = dynamic(["[email protected]", "[email protected]"]);
let RecentLogons =
    IdentityLogonEvents
    | where Timestamp > ago(RecentWindow)
    | where not(AccountUpn has_any (whitelistedAccounts))
    | where Protocol =~ "NTLM"
    | where ActionType != "LogonFailed"
    | extend AccountUpn = tolower(AccountUpn), DeviceName = tolower(DeviceName)
    | extend DeviceGroup = extract(@"^([a-z]+)\d*", 1, DeviceName)
    | summarize DistinctDeviceGroups = dcount(DeviceGroup),
                DeviceGroups = make_set(DeviceGroup),
                Devices = make_set(DeviceName),
                LogonCount = count()
            by AccountUpn;
let HistoricalDeviceGroupsPerAccount =
    IdentityLogonEvents
    | where Timestamp between (ago(Lookback + RecentWindow) .. ago(RecentWindow))
    | where Protocol =~ "NTLM"
    | where ActionType != "LogonFailed"
    | extend AccountUpn = tolower(AccountUpn), DeviceName = tolower(DeviceName)
    | extend DeviceGroup = extract(@"^([a-z]+)\d*", 1, DeviceName)
    | summarize HistoricalDeviceGroups = make_set(DeviceGroup) by AccountUpn;
RecentLogons
| join kind=leftouter HistoricalDeviceGroupsPerAccount on AccountUpn
| extend NewDeviceGroups = set_difference(DeviceGroups, HistoricalDeviceGroups)
| extend NewDeviceGroupCount = array_length(NewDeviceGroups)
| where DistinctDeviceGroups > 1 and NewDeviceGroupCount > 0
| project AccountUpn, DistinctDeviceGroups, LogonCount, NewDeviceGroupCount, NewDeviceGroups, DeviceGroups, Devices
| sort by NewDeviceGroupCount desc
| where isnotempty( AccountUpn)
| where DistinctDeviceGroups >2

About this query

NTLM Network Logon Anomalies (Lateral Movement)

Query Information

MITRE ATT&CK Technique(s)

Technique ID	Title	Link
T1021	Remote Services	https://attack.mitre.org/techniques/T1021/
T1078	Valid Accounts	https://attack.mitre.org/techniques/T1078/
T1550.002	Pass the Hash	https://attack.mitre.org/techniques/T1550/002/

Description

Detects user accounts performing successful NTLM logons across multiple distinct device groups (based on a common prefix) where those device groups have not been accessed by the account in the preceding 30 days. This behavior is indicative of potential lateral movement or account compromise.

Author <Optional>

Name: Benjamin Zulliger
Github: https://github.com/benscha/KQLAdvancedHunting
LinkedIn: https://www.linkedin.com/in/benjamin-zulliger/

Defender XDR

Explanation

This query is designed to detect unusual NTLM logon activities that might indicate lateral movement or account compromise within a network. Here's a simplified explanation of what the query does:

Time Frame and Exclusions:
- It looks at NTLM logon events within the last hour (RecentWindow).
- It excludes certain whitelisted accounts from the analysis.
Data Collection:
- It collects logon events where the logon was successful and the protocol used was NTLM.
- It extracts a "DeviceGroup" from the device name, which is based on a common prefix.
Recent Logon Analysis:
- It counts how many distinct device groups each account has accessed in the last hour.
- It also gathers a list of these device groups and the devices accessed.
Historical Comparison:
- It looks back 30 days (plus the recent hour) to see which device groups each account has accessed historically.
Anomaly Detection:
- It identifies accounts that have accessed more than one distinct device group in the last hour.
- It checks if any of these device groups are new (i.e., not accessed in the past 30 days).
- It filters for accounts that have accessed more than two distinct device groups and have accessed at least one new device group.
Output:
- It lists accounts with their logon details, highlighting the number of new device groups accessed and sorting them by the number of new device groups.

This query helps in identifying potential lateral movement by flagging accounts that suddenly access multiple new device groups, which could indicate unauthorized access or compromised accounts.