Passwd_Spray.yml

detect:
events:
  - NEW_PROCESS
  - EXISITING_PROCESS
  - WEL
op: or
rules:
  - op: and
    rules:
      - op: is windows
        with events:
          event: WEL
          op: is
          path: event/EVENT/System/EventID
          value: '4625'
          count: 5
          within: 60
      - op: is windows
        with events:
          event: WEL
          op: is
          path: event/EVENT/EventData/LogonType
          value: '3'
          count: 5
          within: 60
      - op: is windows
        with events:
          event: WEL
          op: is
          path: event/NETWORK_ACTIVITY/?/DESTINATION/IP_ADDRESS
          value: ''
          count: 5
          within: 60
      - op: is windows
        with events:
          event: WEL
          not: true
          op: is
          path: routing/TargetUserName
          value: $
          count: 5
          within: 60
  - op: and
    rules:
      - op: is windows
      - op: and
        rules:
          - op: or
            rules:
              - case sensitive: false
                op: ends with
                path: event/FILE_PATH
                value: \dsacls.exe
              - case sensitive: false
                op: is
                path: event/ORIGINAL_FILE_NAME
                value: DSACLS.EXE
          - op: and
            rules:
              - case sensitive: false
                op: contains
                path: event/COMMAND_LINE
                value: '/user:'
              - case sensitive: false
                op: contains
                path: event/COMMAND_LINE
                value: '/passwd:'
  - case sensitive: false
    op: contains
    path: event/COMMAND_LINE
    value: crackmapexec
respond:
- action: report

  metadata:
    author: Sawood(TAGTREX), Shehroz(TAGTREX) 
    description: Detecting Password Spray with nested OP's.
    falsepositives:
    level: Medium
    tags:
    - attack.defense_evasion
    - attack.t1218
  name: Password Spraying Detected