Possible PetitPotam Coerce Authentication Attempt — Sigma Rule

Rule metadata and linked tags

Author: Mauricio Velazco, Michael Haag. Source status: test; severity: high. Source dates: 2021-09-02 / 2022-08-11.

{
  "product": "windows",
  "service": "security",
  "definition": "The advanced audit policy setting \"Object Access > Detailed File Share\" must be configured for Success/Failure"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: a2865278a9362df76046133b4cabba3f85e2046f1e2105bb94eed8b3bf825db3

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Possible PetitPotam Coerce Authentication Attempt
id: 1ce8c8a3-2723-48ed-8246-906ac91061a6
status: test
description: Detect PetitPotam coerced authentication activity.
references:
    - https://github.com/topotam/PetitPotam
    - https://github.com/splunk/security_content/blob/0dd6de32de2118b2818550df9e65255f4109a56d/detections/endpoint/petitpotam_network_share_access_request.yml
author: Mauricio Velazco, Michael Haag
date: 2021-09-02
modified: 2022-08-11
tags:
    - attack.credential-access
    - attack.t1187
logsource:
    product: windows
    service: security
    definition: 'The advanced audit policy setting "Object Access > Detailed File Share" must be configured for Success/Failure'
detection:
    selection:
        EventID: 5145
        ShareName|startswith: '\\\\' # looking for the string \\somethink\IPC$
        ShareName|endswith: '\IPC$'
        RelativeTargetName: lsarpc
        SubjectUserName: ANONYMOUS LOGON
    condition: selection
falsepositives:
    - Unknown. Feedback welcomed.
level: high

Original YAML and metadata in JSON

False positives

• Unknown. Feedback welcomed.

Source references

• https://github.com/topotam/PetitPotam
• https://github.com/splunk/security_content/blob/0dd6de32de2118b2818550df9e65255f4109a56d/detections/endpoint/petitpotam_network_share_access_request.yml