Jump to content

What's wrong with my exclusion?


Go to solution Solved by JamesR88,

Recommended Posts

Hi there,

I'm getting many False Positives from Rule F1002 about "Potential Pass the Hash". The main trigger seems to be Event UserLogin of nt auth/system, plus some other users related to system services.

I wrote some Advanced exclusions successfully, but I'm at a loss with this one. What's wrong with it?

<definition>
    <operations>
        <operation type="UserLogin">
            <condition component="UserLogonData" property="LogonType" condition="is" value="0" />
        </operation>
    </operations>
    <operator type="OR">
        <condition component="Enterprise" property="ComputerGroupHierarchy" condition="contains" value="value" />
    </operator>
</definition>

Any help would be appreciated.

Link to comment
Share on other sites

  • Solution

If anyone experiences the same problem, you can solve it with the UserLogin operation and "DonebyUser" condition component. Good luck.

Link to comment
Share on other sites

<definition>
  <process>
    <operator type="AND">
      <condition component="Module" property="SignatureType" condition="greaterOrEqual" value="90"/>
      <condition component="FileItem" property="FileName" condition="is" value="lsass.exe"/>
      <condition component="Module" property="SignerName" condition="is" value="Microsoft Windows Publisher"/>
    </operator>
  </process>
  <operations>
    <operation type="UserLogin">
      <operator type="AND">
        <condition component="UserLogonData" property="LogonType" condition="is" value="0" />
        <condition component="Enterprise" property="ComputerGroupHierarchy" condition="contains" value="value" />
      </operator>
    </operation>
  </operations>
</definition>

How about this rule?

I'm not sure if you can set exclusion without specifying a process and I'm not sure if your rule would even work.

Just from reading your rule I'd say it would exclude every logon type 0 event or if the device it happened on is in a specific OU/Group.
You can also change the last AND to OR in my example if you don't want both conditions to be met.

Link to comment
Share on other sites

Hi @thae, thanks for replying. I eventually did it like so:

  <operations>
    <operation type="UserLogin">
      <operator type="AND">
        <condition component="DoneByUser" property="Sid" condition="is" value="SYSTEM SID HERE" />
      </operator>
    </operation>
  </operations>
Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...