Method and mechanism for detection of pass-the-hash attacks
A method of generating a baseline of expected behavior on a single machine or endpoint to accurately fingerprint the native behavior of the NTLM protocol on that particular endpoint in a network. By limiting the scope of a baseline to a single endpoint, the scope of the baseline can consist of expected behavior (including supported hash functions, version strings and various feature flags). Deviations from these behaviors are considered evidence of a redundant implementation of NTLM utilized by an attacker and thus as evidence of an attempted PTH attack. Using this method it is possible to accurately detect PTH attacks originating from all publicly known non-standard implementations of NTLM existing in tools such as Impacket, Metasploit, and Invoke-TheHash.
1. A computer-implemented method of preventing a malicious attack on a networked system comprising an endpoint machine, the computer-implemented method comprising:
generating, by an agent executing on the endpoint machine, a plurality of baseline fingerprints of system activity of the networked system, the plurality of baseline fingerprints comprising baseline representations of the system activity;
monitoring, by the agent, real-time system activity on the endpoint machine after said plurality of baseline fingerprints is generated;
generating, by the agent, a plurality of real-time fingerprints based on the real-time system activity on the endpoint machine;
determining, by the agent, that a Pass-the-Hash (PTH) attack is occurring by:
comparing the plurality of real-time fingerprints to the plurality of baseline fingerprints based on the endpoint machine, and
detecting a deviation between the plurality of real-time fingerprints and the plurality of baselines fingerprints; and
flagging the real-time system activity associated with the detected deviation.
2. The computer-implemented method of claim 1 wherein the agent collects information on operating system (OS) implemented libraries as a portion of the fingerprint.
3. The computer-implemented method of claim 2 wherein the agent flags a loading of additional libraries.
4. The computer-implemented method of claim 2 wherein the agent examines at least one OS cryptographic library and includes at least one implemented cryptographic technique as part of the fingerprint.
5. The computer-implemented method of claim 4 wherein the agent flags a communication that attempts to force a cryptographic technique that is weaker than an available stronger alternative or standard protocol.
6. The computer-implemented method of claim 1 wherein the agent collects identities of processes using a Hypertext Transfer Protocol (HTTP) user-agent strings as part of the fingerprint.
7. The computer-implemented method of claim 6 wherein the agent detects inconsistencies based on the fingerprint between identities of a single process and user-agent strings being used in communication.
8. The computer-implemented method of claim 6 wherein the agent detect a single process using multiple user-agent strings.
9. The computer-implemented method of claim 8 wherein the agent white-lists known processes allowed to use multiple user-agent strings.
10. The computer-implemented method of claim 9 wherein the known processes are known spiders.
11. The computer-implemented method of claim 1 wherein the agent detects an existence of non-standard implementations of New Technology LAN Manager (NTLM).
12. The computer-implemented method of claim 1 , wherein at least one of the plurality of baseline fingerprints comprises at least one of implemented communication sockets or user agent strings associated with authorized processes running on the endpoint machine.
13. The computer-implemented method of claim 1 , further comprising:
receiving, by the agent, an indication that the detected deviation is a false positive; and
based on the indicating, modifying, by the agent, the plurality of baseline fingerprints to include activity that triggered the flagging.