What's wrong with my exclusion?

[JamesR88 1]

Hi there,

I'm getting many False Positives from Rule F1002 about "Potential Pass the Hash". The main trigger seems to be Event UserLogin of nt auth/system, plus some other users related to system services.

I wrote some Advanced exclusions successfully, but I'm at a loss with this one. What's wrong with it?

<definition>
    <operations>
        <operation type="UserLogin">
            <condition component="UserLogonData" property="LogonType" condition="is" value="0" />
        </operation>
    </operations>
    <operator type="OR">
        <condition component="Enterprise" property="ComputerGroupHierarchy" condition="contains" value="value" />
    </operator>
</definition>

Any help would be appreciated.

[JamesR88 1]

If anyone experiences the same problem, you can solve it with the UserLogin operation and "DonebyUser" condition component. Good luck.

[thae 9]

<definition>
  <process>
    <operator type="AND">
      <condition component="Module" property="SignatureType" condition="greaterOrEqual" value="90"/>
      <condition component="FileItem" property="FileName" condition="is" value="lsass.exe"/>
      <condition component="Module" property="SignerName" condition="is" value="Microsoft Windows Publisher"/>
    </operator>
  </process>
  <operations>
    <operation type="UserLogin">
      <operator type="AND">
        <condition component="UserLogonData" property="LogonType" condition="is" value="0" />
        <condition component="Enterprise" property="ComputerGroupHierarchy" condition="contains" value="value" />
      </operator>
    </operation>
  </operations>
</definition>

How about this rule?

I'm not sure if you can set exclusion without specifying a process and I'm not sure if your rule would even work.

Just from reading your rule I'd say it would exclude every logon type 0 event or if the device it happened on is in a specific OU/Group.
You can also change the last AND to OR in my example if you don't want both conditions to be met.

[JamesR88 1]

Hi @thae, thanks for replying. I eventually did it like so:

  <operations>
    <operation type="UserLogin">
      <operator type="AND">
        <condition component="DoneByUser" property="Sid" condition="is" value="SYSTEM SID HERE" />
      </operator>
    </operation>
  </operations>