Unsecured Credentials

Monitor application logs for activity that may highlight malicious attempts to access application data, especially abnormal search activity targeting passwords and other artifacts related to credentials.^[11]

Analytic 1 - Abnormal search activity targeting passwords and other credential artifacts.

(index=third_party sourcetype IN ("mailserver_logs", "webapp_logs", "appliance_logs") ("search" OR "query" OR "find" OR "grep") ("password" OR "credential" OR "key" OR "secret" OR "token"))

While detecting adversaries accessing credentials may be difficult without knowing they exist in the environment, it may be possible to detect adversary use of credentials they have obtained. Monitor the command-line arguments of executing processes for suspicious words or regular expressions that may indicate searching for a password (for example: password, pwd, login, secure, or credentials). See Valid Accounts for more information.

Analytic 1 - Suspicious commands or regular expressions indicating credential search.

(index=security sourcetype="Powershell" EventCode=4104) OR(index=os sourcetype="linux_secure" action="execve") OR(index=os sourcetype="macos_secure" event_type="execve") | where match(CommandLine, "(?i)(password|credential|secret|key|token|login|passwd|passphrase)")

Monitor for suspicious file access activity, specifically indications that a process is reading multiple files in a short amount of time and/or using command-line arguments indicative of searching for credential material (ex: regex patterns). These may be indicators of automated/scripted credential access behavior. Monitoring when the user's .bash_history is read can help alert to suspicious activity. While users do typically rely on their history of commands, they often access this history through other utilities like "history" instead of commands like cat ~/.bash_history.

Analytic 1 - Multiple file reads in a short period or searching for credential material.

(index=security sourcetype="WinEventLog:Security" EventCode=4663 ObjectName="password" OR ObjectName="credential") OR(index=sysmon sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 TargetObject="password" OR TargetObject="credential") OR(index=os sourcetype="linux_audit" action="open" filepath IN ("password", "credential", "passwd", "shadow", ".pem", ".key")) OR(index=os sourcetype="macos_secure" event_type="open" file_path IN ("password", "credential", "passwd", "shadow", ".pem", ".key"))

Monitor newly executed processes that may search compromised systems to find and obtain insecurely stored credentials.

Analytic 1 - New processes with parameters indicating credential searches.

(index=security sourcetype="WinEventLog:Security" EventCode=4688 CommandLine="password" OR CommandLine="credential") OR(index=sysmon sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 CommandLine="password" OR CommandLine="credential") OR(index=os sourcetype="linux_audit" action="execve" CommandLine="password" OR CommandLine="credential") OR(index=os sourcetype="macos_secure" event_type="execve" CommandLine="password" OR CommandLine="credential")

Monitor for an attempt by a user to gain access to a network or computing resource, often by providing credentials that may search compromised systems to find and obtain insecurely stored credentials.

Analytic 1 - Failed or unusual logon attempts using compromised credentials.

(index=security sourcetype="WinEventLog:Security" EventCode IN (4625, 4648)) OR(index=os sourcetype="linux_secure" message="Failed password" OR message="Invalid user") OR(index=os sourcetype="macos_secure" event_type="authentication_failure" OR message="Failed to authenticate user")

Monitor for unexpected windows registry key being accessed that may search compromised systems to find and obtain insecurely stored credentials.

Analytic 1 - Unauthorized access to registry keys associated with credentials.

index=security sourcetype="WinEventLog:Microsoft-Windows-Security-Auditing" EventCode=4663 ObjectType="Registry" (ObjectName="password" OR ObjectName="credential") | eval AccessAttempt=case( AccessMask="0x1", "Read", AccessMask="0x2", "Write", AccessMask="0x3", "Read/Write", AccessMask="0x4", "Delete", true(), "Unknown")