{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1187","id":"T1187","name":"Forced Authentication","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1187","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"b0b5a08f88dc7f009f3a385d25968c1496077e7a98cc1855329340399be38530","description":"Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept.\n\nThe Server Message Block (SMB) protocol is commonly used in Windows networks for authentication and communication between systems for access to resources and file sharing. When a Windows system attempts to connect to an SMB resource it will automatically attempt to authenticate and send credential information for the current user to the remote system.(Citation: Wikipedia Server Message Block) This behavior is typical in enterprise environments so that users do not need to enter credentials to access network resources.\n\nWeb Distributed Authoring and Versioning (WebDAV) is also typically used by Windows systems as a backup protocol when SMB is blocked or fails. WebDAV is an extension of HTTP and will typically operate over TCP ports 80 and 443.(Citation: Didier Stevens WebDAV Traffic)(Citation: Microsoft Managing WebDAV Security)\n\nAdversaries may take advantage of this behavior to gain access to user account hashes through forced SMB/WebDAV authentication. An adversary can send an attachment to a user through spearphishing that contains a resource link to an external server controlled by the adversary  (i.e. [Template Injection](https://attack.mitre.org/techniques/T1221)), or place a specially crafted file on navigation path for privileged accounts (e.g. .SCF file placed on desktop) or on a publicly accessible share to be accessed by victim(s). When the user's system accesses the untrusted resource, it will attempt authentication and send information, including the user's hashed credentials, over SMB to the adversary-controlled server.(Citation: GitHub Hashjacking) With access to the credential hash, an adversary can perform off-line [Brute Force](https://attack.mitre.org/techniques/T1110) cracking to gain access to plaintext credentials.(Citation: Cylance Redirect to SMB)\n\nThere are several different ways this can occur.(Citation: Osanda Stealing NetNTLM Hashes) Some specifics from in-the-wild use include:\n\n* A spearphishing attachment containing a document with a resource that is automatically loaded when the document is opened (i.e. [Template Injection](https://attack.mitre.org/techniques/T1221)). The document can include, for example, a request similar to <code>file[:]//[remote address]/Normal.dotm</code> to trigger the SMB request.(Citation: US-CERT APT Energy Oct 2017)\n* A modified .LNK or .SCF file with the icon filename pointing to an external reference such as <code>\\\\[remote address]\\pic.png</code> that will force the system to load the resource when the icon is rendered to repeatedly gather credentials.(Citation: US-CERT APT Energy Oct 2017)\n\nAlternatively, by leveraging the <code>EfsRpcOpenFileRaw</code> function, an adversary can send SMB requests to a remote system's MS-EFSRPC interface and force the victim computer to initiate an authentication procedure and share its authentication details. The Encrypting File System Remote Protocol (EFSRPC) is a protocol used in Windows networks for maintenance and management operations on encrypted data that is stored remotely to be accessed over a network. Utilization of <code>EfsRpcOpenFileRaw</code> function in EFSRPC is used to open an encrypted object on the server for backup or restore. Adversaries can collect this data and abuse it as part of a NTLM relay attack to gain access to remote systems on the same internal network.(Citation: Rapid7)(Citation: GitHub)\n\n","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1187","external_id":"T1187"},{"source_name":"Rapid7","description":"Condon, Caitlin. (2022, April 24). PetitPotam: Novel Attack Chain Can Fully Compromise Windows Domains. Retrieved May 30, 2025.","url":"https://www.rapid7.com/blog/post/2021/08/03/petitpotam-novel-attack-chain-can-fully-compromise-windows-domains-running-ad-cs/"},{"source_name":"Cylance Redirect to SMB","description":"Cylance. (2015, April 13). Redirect to SMB. Retrieved December 21, 2017.","url":"https://www.cylance.com/content/dam/cylance/pdfs/white_papers/RedirectToSMB.pdf"},{"source_name":"GitHub Hashjacking","description":"Dunning, J. (2016, August 1). Hashjacking. Retrieved December 21, 2017.","url":"https://github.com/hob0/hashjacking"},{"source_name":"Microsoft Managing WebDAV Security","description":"Microsoft. (n.d.). Managing WebDAV Security (IIS 6.0). Retrieved November 17, 2024.","url":"https://web.archive.org/web/20100210125749/https://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/4beddb35-0cba-424c-8b9b-a5832ad8e208.mspx"},{"source_name":"Osanda Stealing NetNTLM Hashes","description":"Osanda Malith Jayathissa. (2017, March 24). Places of Interest in Stealing NetNTLM Hashes. Retrieved January 26, 2018.","url":"https://osandamalith.com/2017/03/24/places-of-interest-in-stealing-netntlm-hashes/"},{"source_name":"Didier Stevens WebDAV Traffic","description":"Stevens, D. (2017, November 13). WebDAV Traffic To Malicious Sites. Retrieved December 21, 2017.","url":"https://blog.didierstevens.com/2017/11/13/webdav-traffic-to-malicious-sites/"},{"source_name":"GitHub","description":"topotam. (2021, July 18). PetitPotam. PoC tool to coerce Windows hosts to authenticate to other machines. Retrieved May 30, 2025.","url":"https://github.com/topotam/PetitPotam"},{"source_name":"US-CERT APT Energy Oct 2017","description":"US-CERT. (2017, October 20). Alert (TA17-293A): Advanced Persistent Threat Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved November 2, 2017.","url":"https://www.us-cert.gov/ncas/alerts/TA17-293A"},{"source_name":"Wikipedia Server Message Block","description":"Wikipedia. (2017, December 16). Server Message Block. Retrieved December 21, 2017.","url":"https://en.wikipedia.org/wiki/Server_Message_Block"}],"platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0039","name":"File Creation","page":"telemetry/DC0039/","kind":"attack_component","category":"Endpoint activity","description":"Creation or overwrite of a file at an observed path.","collection_focus":"Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","size_bytes"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0061","name":"File Modification","page":"telemetry/DC0061/","kind":"attack_component","category":"Endpoint activity","description":"Changes to file data or attributes.","collection_focus":"Use file-integrity monitoring or scoped OS file-write auditing for general changes. Sysmon 2 records creation-time changes; it is not a general file-write event.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["path","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."}],"detection":{"key":"enterprise/T1187","id":"T1187","name":"Forced Authentication","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1187","technique_page":"techniques/enterprise/T1187/","page":"detections/enterprise/T1187/","status":"rule_source_available","counts":{"sigma":7,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[{"id":"4096842a-8f9f-4d36-92b4-d0b2a62f9b2a","title":"Potential PetitPotam Attack Via EFS RPC Calls","status":"test","level":"medium","logsource":{"product":"zeek","service":"dce_rpc"},"data_path":"data/detection-rules/4096842a-8f9f-4d36-92b4-d0b2a62f9b2a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/zeek/zeek_dce_rpc_potential_petit_potam_efs_rpc_call.yml","author":"@neu5ron, @Antonlovesdnb, Mike Remen","kind":"sigma"},{"id":"5588576c-5898-4fac-bcdd-7475a60e8f43","title":"Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network","status":"experimental","level":"high","logsource":{"product":"zeek","service":"dns"},"data_path":"data/detection-rules/5588576c-5898-4fac-bcdd-7475a60e8f43.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/zeek/zeek_dns_kerberos_coercion_via_dns_object_spn_spoofing.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"1ce8c8a3-2723-48ed-8246-906ac91061a6","title":"Possible PetitPotam Coerce Authentication Attempt","status":"test","level":"high","logsource":{"product":"windows","service":"security","definition":"The advanced audit policy setting \"Object Access > Detailed File Share\" must be configured for Success/Failure"},"data_path":"data/detection-rules/1ce8c8a3-2723-48ed-8246-906ac91061a6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_petitpotam_network_share.yml","author":"Mauricio Velazco, Michael Haag","kind":"sigma"},{"id":"6a53d871-682d-40b6-83e0-b7c1a6c4e3a5","title":"PetitPotam Suspicious Kerberos TGT Request","status":"test","level":"high","logsource":{"product":"windows","service":"security","definition":"The advanced audit policy setting \"Account Logon > Kerberos Authentication Service\" must be configured for Success/Failure"},"data_path":"data/detection-rules/6a53d871-682d-40b6-83e0-b7c1a6c4e3a5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_petitpotam_susp_tgt_request.yml","author":"Mauricio Velazco, Michael Haag","kind":"sigma"},{"id":"e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c","title":"Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing","status":"experimental","level":"high","logsource":{"product":"windows","category":"dns_query"},"data_path":"data/detection-rules/e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/dns_query/dns_query_win_kerberos_coercion_via_dns_object_spoofing.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"916eb839-895e-47f8-99ee-3008bf377a3e","title":"NTLM Hash Leak Via Curl NTLM Authentication","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/916eb839-895e-47f8-99ee-3008bf377a3e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_curl_ntlm_hash_leak_attempt.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"0ed99dda-6a35-11ef-8c99-0242ac120002","title":"Attempts of Kerberos Coercion Via DNS SPN Spoofing","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/0ed99dda-6a35-11ef-8c99-0242ac120002.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_kerberos_coercion_via_dns_spn_spoofing.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0022","name":"Detect Forced SMB/WebDAV Authentication via lure files and outbound NTLM","url":"https://attack.mitre.org/detectionstrategies/DET0022","stix_id":"x-mitre-detection-strategy--b45310bb-d520-43b3-8758-e9d5a9738429","relationship_id":"relationship--9ed19842-ee7d-4215-ae78-6a9382b3f9a1","description":"","analytics":[{"id":"AN0065","name":"Analytic 0065","guidance":"Adversary stages a lure that references a remote resource (e.g., LNK/SCF/Office template). When the user opens/renders the file or a shell enumerates icons, the host automatically attempts SMB or WebDAV authentication to the attacker host. The chain is: (1) lure file is created or modified in a user-exposed location → (2) user or system accesses the lure → (3) host makes outbound NTLM (SMB 139/445 or WebDAV over 80/443) to an untrusted destination → (4) repeated attempts from multiple users/hosts or from privileged workstations.","url":"https://attack.mitre.org/detectionstrategies/DET0022#AN0065","platforms":["Windows"],"tuning":[{"field":"UserLocations","description":"Folders where lures are most effective (Desktop, Public, Downloads, Temp, Cache, Start Menu, Startup). Adjust to enterprise layout."},{"field":"LureExtensions","description":"File types commonly abused (.lnk, .scf, .url, .doc/.xls/.ppt/.pdf/.html). Extend for your tooling and languages."},{"field":"UntrustedCIDR/DNS","description":"Org-specific list of external/unknown networks or domains; used to suppress sanctioned file servers and WebDAV gateways."},{"field":"TimeWindow","description":"Correlation horizon (e.g., 15–30 minutes) between file access and outbound NTLM attempt."},{"field":"WorkstationZones","description":"Asset/zone tags that distinguish workstations from servers; helps flag workstation→workstation SMB, which is often abnormal."},{"field":"OfficeTemplatePaths","description":"Paths to Office templates to catch template injection references and abnormal loads."}],"log_sources":[{"component_id":"DC0039","component":"File Creation","name":"WinEventLog:Sysmon","channel":"EventCode=11","platforms":["Windows"],"analytic_id":"AN0065","source_url":"https://attack.mitre.org/detectionstrategies/DET0022#AN0065","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0061","component":"File Modification","name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","platforms":["Windows"],"analytic_id":"AN0065","source_url":"https://attack.mitre.org/detectionstrategies/DET0022#AN0065","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Flow","channel":"HTTP/WebDAV requests that contain NTLMSSP or PROPFIND/MOVE/OPTIONS with Authorization: NTLM","platforms":["Windows"],"analytic_id":"AN0065","source_url":"https://attack.mitre.org/detectionstrategies/DET0022#AN0065","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"NSM:Flow","channel":"Outbound connections to TCP 139,445 and HTTP/HTTPS to WebDAV endpoints from workstation subnets","platforms":["Windows"],"analytic_id":"AN0065","source_url":"https://attack.mitre.org/detectionstrategies/DET0022#AN0065","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]}]}],"telemetry_references":[{"id":"DC0039","name":"File Creation","tag":"File Creation","page":"telemetry/DC0039/","kind":"attack_component"},{"id":"DC0061","name":"File Modification","tag":"File Modification","page":"telemetry/DC0061/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0634","name":"EnvyScout","url":"https://attack.mitre.org/software/S0634","kind":"malware","description":"[EnvyScout](https://attack.mitre.org/software/S0634) can use protocol handlers to coax the operating system to send NTLMv2 authentication responses to attacker-controlled infrastructure.(Citation: MSTIC Nobelium Toolset May 2021)","relationship_id":"relationship--ee1dd5bc-9d75-4f46-87a1-12fcb7183f32","references":[{"source_name":"MSTIC Nobelium Toolset May 2021","description":"MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021.","url":"https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"}]}],"actors":[{"id":"G0035","name":"Dragonfly","url":"https://attack.mitre.org/groups/G0035","kind":"intrusion-set","description":"[Dragonfly](https://attack.mitre.org/groups/G0035) has gathered hashed user credentials over SMB using spearphishing attachments with external resource links and by modifying .LNK file icon resources to collect credentials from virtualized systems.(Citation: US-CERT TA18-074A)(Citation: Gigamon Berserk Bear October 2021)","relationship_id":"relationship--db7707d7-5334-47b3-b203-0ee4fcbae5e9","references":[{"source_name":"US-CERT TA18-074A","description":"US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"},{"source_name":"Gigamon Berserk Bear October 2021","description":"Slowik, J. (2021, October). THE BAFFLING BERSERK BEAR: A DECADE’S ACTIVITY TARGETING CRITICAL INFRASTRUCTURE. Retrieved December 6, 2021.","url":"https://vblocalhost.com/uploads/VB2021-Slowik.pdf"}]},{"id":"G0079","name":"DarkHydrus","url":"https://attack.mitre.org/groups/G0079","kind":"intrusion-set","description":"[DarkHydrus](https://attack.mitre.org/groups/G0079) used [Template Injection](https://attack.mitre.org/techniques/T1221) to launch an authentication window for users to enter their credentials.(Citation: Unit 42 Phishery Aug 2018)","relationship_id":"relationship--2db02b07-4dd3-4810-9103-1f8d7bd46a60","references":[{"source_name":"Unit 42 Phishery Aug 2018","description":"Falcone, R. (2018, August 07). DarkHydrus Uses Phishery to Harvest Credentials in the Middle East. Retrieved August 10, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/08/unit42-darkhydrus-uses-phishery-harvest-credentials-middle-east/"}]}],"mitigations":[{"id":"M1027","name":"Password Policies","url":"https://attack.mitre.org/mitigations/M1027","kind":"course-of-action","description":"Use strong passwords to increase the difficulty of credential hashes from being cracked if they are obtained.","relationship_id":"relationship--6537d47a-80c0-442b-a1ec-3451d078a2a9","references":[]},{"id":"M1037","name":"Filter Network Traffic","url":"https://attack.mitre.org/mitigations/M1037","kind":"course-of-action","description":"\nBlock SMB traffic from exiting an enterprise network with egress filtering or by blocking TCP ports 139, 445 and UDP port 137. Filter or block WebDAV protocol traffic from exiting the network. If access to external resources over SMB and WebDAV is necessary, then traffic should be tightly limited with allowlisting. (Citation: US-CERT SMB Security) (Citation: US-CERT APT Energy Oct 2017)","relationship_id":"relationship--85c9285a-6738-42dd-aa12-fbded3e7bbdb","references":[{"source_name":"US-CERT SMB Security","description":"US-CERT. (2017, March 16). SMB Security Best Practices. Retrieved December 21, 2017.","url":"https://www.us-cert.gov/ncas/current-activity/2017/01/16/SMB-Security-Best-Practices"},{"source_name":"US-CERT APT Energy Oct 2017","description":"US-CERT. (2017, October 20). Alert (TA17-293A): Advanced Persistent Threat Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved November 2, 2017.","url":"https://www.us-cert.gov/ncas/alerts/TA17-293A"}]}],"candidates":[{"id":"485ce873-2e65-4706-9c7e-ae3ab9e14213","name":"PetitPotam","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1187/T1187.yaml","description":"This module runs the Windows executable of PetitPotam in order to coerce authentication for a remote system.\n","inputs":{"captureServerIP":{"description":"Computer IP to use to receive the authentication (ex. attacker machine used for NTLM relay)","type":"string","default":"10.0.0.3"},"targetServerIP":{"description":"Computer IP to force authentication from (ex. domain controller)","type":"string","default":"10.0.0.2"},"efsApi":{"description":"EFS API to use to coerce authentication","type":"integer","default":1},"petitpotam_path":{"description":"PetitPotam Windows executable","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\PetitPotam.exe"}},"dependencies":[{"description":"PetitPotam binary must exist on disk and at specified location (#{petitpotam_path}).\nAnd the computer must be domain joined (implicit authentication).\n"}],"source_definition_sha256":"0dcfbb05e6803f76992590c246ee32b60f58957e1b2d7169158c814a5fca14b2"},{"id":"7f06b25c-799e-40f1-89db-999c9cc84317","name":"WinPwn - PowerSharpPack - Retrieving NTLM Hashes without Touching LSASS","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1187/T1187.yaml","description":"PowerSharpPack - Retrieving NTLM Hashes without Touching LSASS technique via function of WinPwn","inputs":{},"dependencies":[],"source_definition_sha256":"c3d1fe7e7dcf7d09d0481f289a43119844246e4bdf7a1eec6cd8c044d9040f71"},{"id":"81cfdd7f-1f41-4cc5-9845-bb5149438e37","name":"Trigger an authenticated RPC call to a target server with no Sign flag set","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1187/T1187.yaml","description":"RpcPing command can be used to trigger an authenticated RPC call to the target server (/s) that could be relayed to a privileged resource (Sign flag not Set)\nRef: https://twitter.com/splinter_code/status/1421144623678988298","inputs":{"custom_port":{"description":"Specify the custom port number","type":"integer","default":"9997"},"server_ip":{"description":"Specify the server IP address. If not specified, the loop back IP will be used","type":"string","default":"127.0.0.1"}},"dependencies":[],"source_definition_sha256":"be8f4d9b8823eaf54f01f6dd3c1c4c5ee289b3ac449d21eec1239f275aff1126"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1221":"/ttp-simulation/techniques/enterprise/T1221/","T1110":"/ttp-simulation/techniques/enterprise/T1110/","T1187":"/ttp-simulation/techniques/enterprise/T1187/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1187","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}}]}}