JamesR88 1 Posted March 12 Share Posted March 12 Hi there, I'm getting many False Positives from Rule F1002 about "Potential Pass the Hash". The main trigger seems to be Event UserLogin of nt auth/system, plus some other users related to system services. I wrote some Advanced exclusions successfully, but I'm at a loss with this one. What's wrong with it? <definition> <operations> <operation type="UserLogin"> <condition component="UserLogonData" property="LogonType" condition="is" value="0" /> </operation> </operations> <operator type="OR"> <condition component="Enterprise" property="ComputerGroupHierarchy" condition="contains" value="value" /> </operator> </definition> Any help would be appreciated. Quote Link to comment Share on other sites More sharing options...
Solution JamesR88 1 Posted March 12 Author Solution Share Posted March 12 If anyone experiences the same problem, you can solve it with the UserLogin operation and "DonebyUser" condition component. Good luck. Quote Link to comment Share on other sites More sharing options...
thae 4 Posted March 13 Share Posted March 13 <definition> <process> <operator type="AND"> <condition component="Module" property="SignatureType" condition="greaterOrEqual" value="90"/> <condition component="FileItem" property="FileName" condition="is" value="lsass.exe"/> <condition component="Module" property="SignerName" condition="is" value="Microsoft Windows Publisher"/> </operator> </process> <operations> <operation type="UserLogin"> <operator type="AND"> <condition component="UserLogonData" property="LogonType" condition="is" value="0" /> <condition component="Enterprise" property="ComputerGroupHierarchy" condition="contains" value="value" /> </operator> </operation> </operations> </definition> How about this rule? I'm not sure if you can set exclusion without specifying a process and I'm not sure if your rule would even work. Just from reading your rule I'd say it would exclude every logon type 0 event or if the device it happened on is in a specific OU/Group. You can also change the last AND to OR in my example if you don't want both conditions to be met. JamesR88 1 Quote Link to comment Share on other sites More sharing options...
JamesR88 1 Posted March 13 Author Share Posted March 13 Hi @thae, thanks for replying. I eventually did it like so: <operations> <operation type="UserLogin"> <operator type="AND"> <condition component="DoneByUser" property="Sid" condition="is" value="SYSTEM SID HERE" /> </operator> </operation> </operations> thae 1 Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.