Nterl0k - T1110.003 NTLM Bruteforce

[nterl0k]

Details

A set of detections bult to detect anomalous behaviors using the NTLM Operational via organization domain controllers.

• https://www.varonis.com/blog/investigate-ntlm-brute-force
• https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/ntlm-blocking-and-you-application-analysis-and-auditing/ba-p/397191
• https://techcommunity.microsoft.com/t5/microsoft-defender-for-identity/enriched-ntlm-authentication-data-using-windows-event-8004/m-p/871827

Pending splunk/attack_data#887

Checklist

• Validate name matches <platform>_<mitre att&ck technique>_<short description> nomenclature
• CI/CD jobs passed ✔️
• Validated SPL logic.
• Validated tags, description, and how to implement.
• Verified references match analytic.

[ljstella]

LGTM!

Thanks for you contribution @nterl0k. Only small change I had to make was one of the risk messages referencing a field that didn't exist in the search. Super easy fix. Thanks again!