Understanding throughly PTH alert: on what is it triggering?

[keith_be]

Hi,

One of our customers is using the Microsoft ATA for some time now. We noticed for several months   "Identity theft using Pass-the-hash attack" alerts on the same machine by the same user. Forensically investigating this machine we don't see any abnormal or suspicious behavior/activity. According to the ATA tuning  guide you need to determine if the hash was used from computers the user is using regularly, to check if the alert is a false positive or not. This is clearly the case. So it is inline with our forensic investigation. But I am still interested to understand why the alert is triggering for this particular user on this particular workstation. Especially if I want to exclude this alert in the future for this particular user. Could you shine some light on the internals how this alert mechanism is working?

Kind regards,

Keith

[#2]

Hi @keith_be ,

We can't expose our logics, but Pass the Hash alert is triggered when an anomaly which indicates a potential PTH attack is identified. There are known issues of Citrix environment and this alert, maybe this is the case you are eperiencing?

Thanks,

Tali

[#3]

Hi Tali,

Thanks for your response. I was already afraid you couldn't share the logic. Maybe it is possible to share with specific partners. Tuning a detection capability without knowing the internal logics is rather difficult. I believe Citrix is using passthrough authentication and that might trigger the alert. Strangely in the environment I am talking about, this is not always triggering. We cannot simulate it. Any further details or detailed guidance (maybe offline) would be highly appreciated.

Kind regards,
Keith

[#4]

Thanks for mentioning "known issues with Citrix and pass-the-hash alerts." That aligns with our false positive.

But come on, when I hear a vendor say "we can't expose the logic used to create this alert," as an analyst, I think "I don't want to use that tool." I just wasted 3 days looking into a system and the related domain controller looking for anomalous or suspicious evidence because 1) the alert didn't contain NEARLY enough information for me to make an educated decision (like what commands were used, how did the system determine this was worthy of an alert, if and what binaries were involved), and 2) researching the alert online didn't give me any additional useful information.

Vendor responses like this make me want to disable any of those alerts and create my own. At least I understand how my custom alerts are triggered and I can tune them.

</disappointment>