Potential Local NTLM Relay via HTTP

  1[metadata]
  2creation_date = "2022/04/30"
  3integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies attempts to coerce local NTLM authentication over HTTP through WebDAV named-pipe paths such as
 11Print Spooler or SRVSVC. Adversaries can combine this primitive with relay tooling to elevate privileges.
 12"""
 13from = "now-9m"
 14index = [
 15    "endgame-*",
 16    "logs-crowdstrike.fdr*",
 17    "logs-endpoint.events.process-*",
 18    "logs-m365_defender.event-*",
 19    "logs-sentinel_one_cloud_funnel.*",
 20    "logs-system.security*",
 21    "logs-windows.forwarded*",
 22    "logs-windows.sysmon_operational-*",
 23    "winlogbeat-*",
 24]
 25language = "eql"
 26license = "Elastic License v2"
 27name = "Potential Local NTLM Relay via HTTP"
 28references = [
 29    "https://github.com/med0x2e/NTLMRelay2Self",
 30    "https://github.com/topotam/PetitPotam",
 31    "https://github.com/dirkjanm/krbrelayx/blob/master/printerbug.py",
 32]
 33risk_score = 73
 34rule_id = "4682fd2c-cfae-47ed-a543-9bed37657aa6"
 35severity = "high"
 36tags = [
 37    "Domain: Endpoint",
 38    "OS: Windows",
 39    "Use Case: Threat Detection",
 40    "Tactic: Credential Access",
 41    "Tactic: Defense Evasion",
 42    "Data Source: Elastic Endgame",
 43    "Data Source: Elastic Defend",
 44    "Data Source: Windows Security Event Logs",
 45    "Data Source: Microsoft Defender XDR",
 46    "Data Source: Sysmon",
 47    "Data Source: SentinelOne",
 48    "Data Source: Crowdstrike",
 49    "Resources: Investigation Guide",
 50    "Noise: Medium",
 51    "Performance: Normal",
 52    "Profile: Recommended",
 53    "Threat: Living off the Land",
 54    "Rule Type: Event Correlation (EQL)",
 55    "Platform: Windows",
 56]
 57timestamp_override = "event.ingested"
 58type = "eql"
 59
 60query = '''
 61process where host.os.type == "windows" and event.type == "start" and
 62  process.name : "rundll32.exe" and
 63
 64  /* Rundll32 WbeDav Client  */
 65  process.args : ("?:\\Windows\\System32\\davclnt.dll,DavSetCookie", "?:\\Windows\\SysWOW64\\davclnt.dll,DavSetCookie") and
 66
 67  /* Access to named pipe via http */
 68  process.args : ("http*/print/pipe/*", "http*/pipe/spoolss", "http*/pipe/srvsvc")
 69'''
 70
 71note = """## Triage and analysis
 72
 73### Investigating Potential Local NTLM Relay via HTTP
 74
 75#### Possible investigation steps
 76
 77- Does the alert-local command line confirm WebDAV-to-named-pipe relay behavior?
 78  - Focus: `process.command_line` and `process.executable`; confirm rundll32.exe loads davclnt.dll,DavSetCookie and targets HTTP pipe paths: /print/pipe/, /pipe/spoolss, or /pipe/srvsvc.
 79  - Implication: escalate when one command combines DavSetCookie with HTTP named-pipe paths, matching NTLMRelay2Self and printerbug-style coercion; close only when exact `process.command_line`, `user.id`, and `host.id` tie to authorized relay testing or explicit WebDAV/print diagnostics intentionally exercising this path.
 80
 81- Is the binary identity and launch chain consistent with the relay context?
 82  - Focus: `process.executable`, `process.pe.original_file_name`, `process.code_signature.subject_name`, `process.parent.executable`, and `process.parent.command_line`.
 83  - Implication: escalate when rundll32.exe is renamed, outside a Windows system path, launched by a script, document, remote-management, or user-writable parent, or signer-mismatched; lower suspicion only when identity and parent chain match the authorized test or diagnostic workflow. Identity alone does not clear relay behavior.
 84
 85- Did the process contact the HTTP listener implied by the relay path?
 86  - Focus: if endpoint network telemetry exists, recover process network events with `host.id` plus `process.entity_id`; fallback to `host.id` plus `process.pid` in a tight window. Read DNS via `dns.question.name`; connections via `destination.ip` and `destination.port`. $investigate_2
 87  - Hint: compare destinations to the HTTP host in `process.command_line`; loopback, same-host aliases, private listeners, or unexpected external HTTP infrastructure are decisive.
 88  - Implication: escalate when traffic reaches the listener named by the relay command or an unexplained HTTP endpoint. Missing endpoint network or DNS telemetry is unresolved, not benign.
 89
 90- Did authentication events explain the local rundll32 session or relay follow-on?
 91  - Why: the process alert proves relay intent; Windows Security events can explain the operator session, while relay proof may surface as inbound NTLM on this host, target-host authentication, or DC-side validation.
 92  - Focus: for local session context, bridge `process.Ext.authentication_id` to same-host `winlog.event_data.TargetLogonId`; on 4624, read `winlog.event_data.AuthenticationPackageName` and `source.ip`. $investigate_3
 93  - Hint: for relay proof, search same-host inbound NTLM without `user.id`, target-host 4624/4625, and DC-side 4776 using the listener, reconstructed targets, or source addresses from command/network evidence. Search 4648 on `winlog.event_data.SubjectLogonId` only for explicit credentials from the local session.
 94  - Implication: escalate when the local session origin is unexplained, same-host inbound NTLM appears around the alert, or target/DC authentication shows coerced machine or service-account use tied to the listener or targets. Missing authentication telemetry is unresolved, not benign.
 95
 96- Is there follow-on execution, tooling, or repeated coercion around the process?
 97  - Focus: child processes where `process.parent.entity_id` matches `process.entity_id`, reading `process.Ext.token.integrity_level_name`; if endpoint file telemetry exists, recover files with `host.id` plus `process.entity_id`, or `host.id` plus `process.pid` in a tight window, then read `file.path`. $investigate_4
 98  - Hint: look for command lines or artifacts naming PetitPotam, printerbug, NTLMRelay2Self, ntlmrelayx, shadow credentials, RBCD, or WebClient/Print Spooler preparation.
 99  - Implication: escalate when the window shows dropped tools, secondary scripts, repeated rundll32.exe relay attempts, privileged child processes, or WebClient/Print Spooler preparation. Missing endpoint file telemetry limits corroboration, not the alert-local finding.
100
101- If local evidence is suspicious or unresolved, do related alerts change scope?
102  - Focus: related alerts for `user.id` covering credential access, relay testing, privilege escalation, or lateral movement. $investigate_0
103  - Hint: compare related alerts for `host.id` for spooler abuse, WebClient activity, remote execution, NTLM relay, or coercion patterns. $investigate_1
104  - Implication: broaden when either pivot shows repeated relay/coercion or credential-access activity outside the authorized test or diagnostic; keep local when both stay confined to that activity.
105
106- Escalate when relay-path arguments plus binary lineage, listener contact, NTLM/auth evidence, follow-on tooling, or related alerts indicate unauthorized relay; close only when alert-local evidence and supported recovery fit one authorized workflow; preserve and escalate if evidence is mixed or incomplete.
107
108### False positive analysis
109
110- Authorized red-team, purple-team, relay-lab validation, or explicit WebDAV/print diagnostics can trigger this rule. Confirm that `process.command_line`, `process.parent.executable`, `user.id`, `host.id`, destination evidence if available, and authentication evidence all align with that activity. Routine WebDAV or print troubleshooting is insufficient unless it explains the DavSetCookie-to-HTTP-pipe pattern.
111- Without workflow records, require a telemetry-only match across prior alerts from this rule: same `process.parent.executable`, exact `process.command_line` pattern, `user.id`, `host.id`, and supported destination or authentication pattern. Build exceptions only from that full workflow; avoid exceptions on rundll32.exe, davclnt.dll, or the pipe path alone.
112
113### Response and remediation
114
115- If confirmed benign, release temporary containment and document the workflow anchors: `process.executable`, `process.parent.executable`, exact `process.command_line`, `user.id`, `host.id`, and the recovered destination or authentication evidence. Create an exception only when the same full workflow recurs across prior alerts from this rule.
116- If suspicious but unconfirmed, preserve the alert details, `process.entity_id` or `process.pid`, `process.command_line`, `process.parent.command_line`, process tree, recovered network or DNS records, Windows Security records, and file artifacts before containment. Apply reversible containment first, such as temporary HTTP/WebDAV restrictions or heightened monitoring on the host; isolate only if repeated relay attempts, corroborating NTLM activity, follow-on execution, or exposure on a domain controller, print server, or jump host raises the risk and the asset can tolerate isolation.
117- If confirmed malicious, preserve the command line, process tree, listener details, authentication records, and dropped artifacts first. Then isolate the host through endpoint response when the evidence establishes unauthorized relay, and kill or suspend the responsible process if it is still active. Block confirmed malicious listeners, path fragments, hashes, or follow-on tools before cleanup.
118- If investigation shows successful relay or privileged machine/service-account use, review and rotate affected credentials or secrets according to privilege tier, and coordinate disruptive identity or infrastructure changes before acting on domain controllers, print servers, or jump hosts.
119- Before eradication, scope the same command fragment, listener, `user.id`, `host.id`, authentication indicators, and adjacent tooling across other hosts and sessions so evidence is not destroyed before spread is understood. Then remove the relay tooling and harden the exposed path, including unnecessary WebClient or Print Spooler exposure, NTLM relay mitigations, and service-specific controls identified during the investigation.
120- Post-incident hardening: retain process, endpoint network, endpoint file, and Windows Security telemetry needed for this correlation, and document adjacent PetitPotam, printerbug, NTLMRelay2Self, or alternate coercion evidence for future triage.
121"""
122
123setup = """## Setup
124
125This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
126
127Setup instructions: https://ela.st/install-elastic-defend
128
129### Additional data sources
130
131This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
132
133- [CrowdStrike](https://ela.st/crowdstrike-integration)
134- [Microsoft Defender XDR](https://ela.st/m365-defender)
135- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
136- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
137- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
138"""
139
140[rule.investigation_fields]
141field_names = [
142    "@timestamp",
143    "host.id",
144    "host.name",
145    "user.id",
146    "user.name",
147    "process.entity_id",
148    "process.pid",
149    "process.executable",
150    "process.command_line",
151    "process.pe.original_file_name",
152    "process.parent.executable",
153    "process.parent.command_line",
154    "process.code_signature.subject_name",
155    "process.code_signature.trusted",
156    "process.Ext.authentication_id",
157]
158
159[transform]
160
161[[transform.investigate]]
162label = "Alerts associated with the user"
163description = ""
164providers = [
165  [
166    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
167    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
168  ]
169]
170relativeFrom = "now-48h/h"
171relativeTo = "now"
172
173[[transform.investigate]]
174label = "Alerts associated with the host"
175description = ""
176providers = [
177  [
178    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
179    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
180  ]
181]
182relativeFrom = "now-48h/h"
183relativeTo = "now"
184
185[[transform.investigate]]
186label = "Network events for the relay process"
187description = ""
188providers = [
189  [
190    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
191    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
192    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" }
193  ]
194]
195relativeFrom = "now-1h"
196relativeTo = "now"
197
198[[transform.investigate]]
199label = "Windows Security events for the local process session"
200description = ""
201providers = [
202  [
203    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
204    { excluded = false, field = "winlog.event_data.TargetLogonId", queryType = "phrase", value = "{{process.Ext.authentication_id}}", valueType = "string" },
205    { excluded = false, field = "event.code", queryType = "phrase", value = "4624", valueType = "string" }
206  ],
207  [
208    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
209    { excluded = false, field = "winlog.event_data.SubjectLogonId", queryType = "phrase", value = "{{process.Ext.authentication_id}}", valueType = "string" },
210    { excluded = false, field = "event.code", queryType = "phrase", value = "4648", valueType = "string" }
211  ]
212]
213relativeFrom = "now-24h"
214relativeTo = "now"
215
216[[transform.investigate]]
217label = "Child process events for the relay process"
218description = ""
219providers = [
220  [
221    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
222    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
223    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" }
224  ]
225]
226relativeFrom = "now-1h"
227relativeTo = "now"
228
229[[rule.threat]]
230framework = "MITRE ATT&CK"
231
232[[rule.threat.technique]]
233id = "T1187"
234name = "Forced Authentication"
235reference = "https://attack.mitre.org/techniques/T1187/"
236
237[[rule.threat.technique]]
238id = "T1212"
239name = "Exploitation for Credential Access"
240reference = "https://attack.mitre.org/techniques/T1212/"
241
242[[rule.threat.technique]]
243id = "T1557"
244name = "Adversary-in-the-Middle"
245reference = "https://attack.mitre.org/techniques/T1557/"
246
247[rule.threat.tactic]
248id = "TA0006"
249name = "Credential Access"
250reference = "https://attack.mitre.org/tactics/TA0006/"
251
252[[rule.threat]]
253framework = "MITRE ATT&CK"
254
255[[rule.threat.technique]]
256id = "T1218"
257name = "System Binary Proxy Execution"
258reference = "https://attack.mitre.org/techniques/T1218/"
259
260[[rule.threat.technique.subtechnique]]
261id = "T1218.011"
262name = "Rundll32"
263reference = "https://attack.mitre.org/techniques/T1218/011/"
264
265[rule.threat.tactic]
266id = "TA0005"
267name = "Defense Evasion"
268reference = "https://attack.mitre.org/tactics/TA0005/"