Microsoft Sentinel KQL: Detecting Credential Theft and Pass-the-Hash Attacks

Explore Our Microsoft Cloud Security Training →

In today’s cybersecurity landscape, detecting Pass-the-Hash (PtH) and credential theft attacks is crucial. This guide demonstrates how to write KQL queries in Microsoft Sentinel to accomplish this task.

Pass-the-Hash and Credential Theft Attacks in Logs

To understand these attacks, we first need to recognize their appearance in logs. PtH occurs when an attacker obtains a hashed version of a user’s credentials, allowing them to authenticate without needing the original password.

Credential theft involves unauthorized access to usernames and passwords, often through phishing or malware attacks.

Writing KQL Queries to Detect PtH

To identify PtH in SecurityEvent logs, we target EventID 4624 (Logon Type 3) anomalies. These events occur when a user logs on using credentials stored on the system (e.g., LM or NTLM).

SecurityEvent
| where EventID == 4624 and LogonType == 3

Combining KQL Queries with UEBA Entity Risk Scores

To further refine our search, we can combine our KQL queries with User and Entity Behavior Analytics (UEBA) entity risk scores. This approach helps identify high-risk accounts involved in potential attacks.

SecurityEvent
| where EventID == 4624 and LogonType == 3
| join EntityRisk
    on $left.UserName == $right.Identity

Creating Analytics Rules for Credential Theft Detection

Based on our refined queries, we can create analytics rules with medium-high severity to alert us when potential credential theft or PtH attacks occur.

Responding to Confirmed Credential Theft Incidents

Upon receiving an alert, it’s essential to respond quickly and efficiently. This might involve resetting the affected user’s password, investigating further, or taking additional remediation steps.

Conclusion

By learning how to write KQL queries in Microsoft Sentinel, you can detect PtH and credential theft attacks more effectively. Mastering these techniques will empower your SOC analysts and threat hunters to better protect your organization’s valuable data.

Take your skills to the next level:

• Microsoft Cloud Security Training: Enhance your knowledge of Microsoft’s cloud security solutions.

Explore Our Microsoft Cloud Security Training →