Pass the Hash - Silencing Noise

[Logan Simmons]

Hi!

We have a software deployment server that accesses other pc's in our environment that uses LAPS as credentials for install.

I am receiving a lot of alerts (SID# 92652: Successful Remote Logon Detected - NTLM authentication, possible pass-the-hash attack).

I would like to silence the alerts from these accounts/machine pushing the software. Below is my custom rule, but wazuh seems to ignore it. Formatting is correct but as I type this the below looks a little wonky from pasting.

  <rule id="10021" level="0">
    <if_matched_sid>92652</if_matched_sid>
    <field name="win.eventdata.targetUserName">^LAPSAdmin$|^lapsadmin$</field>
    <field name="win.eventdata.workstationName">^PDQ-DEPLOY$</field>
    <description>Silencing PDQ-Deploy installments (Remote Logon)</description>
  </rule>

Am I doing something wrong? I have had success with other rules. Just specifically not this one. All help is appreciated in advance!

[Jesus Linares]

Hi,

Probably, the issue is that you are using "if_matched_sid" instead of "if_sid". Here is the difference:

• if_sid: It works similar to parent decoder. It will match when a rule ID on the list has previously matched.
  
• if_matched_sid: Similar to if_sid but it will only match if the ID has been triggered in a period of time.
  

So, your rule should look like:

 <rule id="10021" level="0">

    <if_sid>92652</if_sid>

    <field name="win.eventdata.targetUserName">^LAPSAdmin$|^lapsadmin$</field>
    <field name="win.eventdata.workstationName">^PDQ-DEPLOY$</field>
    <description>Silencing PDQ-Deploy installments (Remote Logon)</description>
  </rule>

If it doesn't work, please, share the alert that you want to ignore in order to review the fields.

I hope it helps.

[Logan Simmons]

Thank you! I was unsure of the difference between the 2. I will try that out and report back

[Logan Simmons]

Can confirm that works. Thank you again as I did not see in the documentation the difference between the two

[Jesus Linares]

Great. I'm glad to help!