JamesR88 1 Posted March 12, 2023 Share Posted March 12, 2023 Hi there, I'm getting many False Positives from Rule F1002 about "Potential Pass the Hash". The main trigger seems to be Event UserLogin of nt auth/system, plus some other users related to system services. I wrote some Advanced exclusions successfully, but I'm at a loss with this one. What's wrong with it? <definition> <operations> <operation type="UserLogin"> <condition component="UserLogonData" property="LogonType" condition="is" value="0" /> </operation> </operations> <operator type="OR"> <condition component="Enterprise" property="ComputerGroupHierarchy" condition="contains" value="value" /> </operator> </definition> Any help would be appreciated. Link to comment Share on other sites More sharing options...
Solution JamesR88 1 Posted March 12, 2023 Author Solution Share Posted March 12, 2023 If anyone experiences the same problem, you can solve it with the UserLogin operation and "DonebyUser" condition component. Good luck. Link to comment Share on other sites More sharing options...
thae 14 Posted March 13, 2023 Share Posted March 13, 2023 <definition> <process> <operator type="AND"> <condition component="Module" property="SignatureType" condition="greaterOrEqual" value="90"/> <condition component="FileItem" property="FileName" condition="is" value="lsass.exe"/> <condition component="Module" property="SignerName" condition="is" value="Microsoft Windows Publisher"/> </operator> </process> <operations> <operation type="UserLogin"> <operator type="AND"> <condition component="UserLogonData" property="LogonType" condition="is" value="0" /> <condition component="Enterprise" property="ComputerGroupHierarchy" condition="contains" value="value" /> </operator> </operation> </operations> </definition> How about this rule? I'm not sure if you can set exclusion without specifying a process and I'm not sure if your rule would even work. Just from reading your rule I'd say it would exclude every logon type 0 event or if the device it happened on is in a specific OU/Group. You can also change the last AND to OR in my example if you don't want both conditions to be met. JamesR88 1 Link to comment Share on other sites More sharing options...
JamesR88 1 Posted March 13, 2023 Author Share Posted March 13, 2023 Hi @thae, thanks for replying. I eventually did it like so: <operations> <operation type="UserLogin"> <operator type="AND"> <condition component="DoneByUser" property="Sid" condition="is" value="SYSTEM SID HERE" /> </operator> </operation> </operations> thae 1 Link to comment Share on other sites More sharing options...
Recommended Posts