Detect Reversible Encryption in IBM QRadar
Adversaries may enable the AllowReversiblePasswordEncryption property on Active Directory user accounts to gain access to plaintext credentials. When enabled, Active Directory stores user passwords in a reversibly encrypted form (G$RADIUSCHAP in userParameters) rather than as one-way hashes. An adversary with SYSTEM access can decrypt these passwords using four components from AD user structures and LSA secrets. Adversaries can set this via PowerShell (Set-ADUser -AllowReversiblePasswordEncryption $true), Local Group Policy, or Fine-Grained Password Policy (FGPP) if Domain Functional Level is Windows Server 2008+.
MITRE ATT&CK
- Technique
- T1556 Modify Authentication Process
- Sub-technique
- T1556.005 Reversible Encryption
- Canonical reference
- https://attack.mitre.org/techniques/T1556/005/
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
logsourcename(logsourceid) AS log_source,
username,
QIDNAME(qid) AS event_name,
"Account Name" AS target_account,
"Account Domain" AS target_domain,
"Caller User Name" AS subject_account,
UTF8(payload) AS raw_payload
FROM events
WHERE LOGSOURCETYPEID(logsourceid) = 12
AND eventid = 4738
AND (
UTF8(payload) ILIKE '%ENCRYPTED_TEXT_PASSWORD_ALLOWED%'
OR UTF8(payload) ILIKE '%%%2054%'
)
AND DATEFORMAT(starttime, 'YYYY-MM-dd') >= DATEFORMAT(NOW() - 86400000, 'YYYY-MM-dd')
UNION
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
logsourcename(logsourceid) AS log_source,
username,
QIDNAME(qid) AS event_name,
'N/A' AS target_account,
'N/A' AS target_domain,
username AS subject_account,
UTF8(payload) AS raw_payload
FROM events
WHERE LOGSOURCETYPEID(logsourceid) IN (12, 13)
AND eventid IN (1, 4688)
AND (
UTF8(payload) ILIKE '%AllowReversiblePasswordEncryption%'
OR UTF8(payload) ILIKE '%Set-ADUser%'
OR UTF8(payload) ILIKE '%Set-ADDefaultDomainPasswordPolicy%'
OR UTF8(payload) ILIKE '%New-ADFineGrainedPasswordPolicy%'
)
AND (
UTF8(payload) ILIKE '%$true%'
OR UTF8(payload) ILIKE '%true%'
)
AND DATEFORMAT(starttime, 'YYYY-MM-dd') >= DATEFORMAT(NOW() - 86400000, 'YYYY-MM-dd')
ORDER BY starttime DESC
LAST 24 HOURSAQL query against QRadar detecting Security Event 4738 with reversible encryption UAC flag (%%2054 / ENCRYPTED_TEXT_PASSWORD_ALLOWED) and PowerShell process events (EventID 1 or 4688) containing AD cmdlets used to enable reversible password encryption.
Data Sources
Required Tables
False Positives & Tuning
- Network Policy Server (NPS) or RADIUS infrastructure administrators legitimately enabling reversible encryption for MS-CHAPv2 dial-up or VPN authentication
- Domain configuration scripts run during new server provisioning that evaluate or set password policy baselines
- Scheduled compliance scans that invoke PowerShell AD cmdlets to audit current password policy settings
Other platforms for T1556.005
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Enable Reversible Password Encryption on a Test Account
Expected signal: Security Event ID 4738: User Account Changed for testuser_atomic, with UserAccountControl value showing ENCRYPTED_TEXT_PASSWORD_ALLOWED. PowerShell ScriptBlock Log Event ID 4104 with the Set-ADUser command. Sysmon Event ID 1 for powershell.exe with AllowReversiblePasswordEncryption in CommandLine.
- Test 2Audit Accounts with Reversible Encryption Enabled
Expected signal: PowerShell ScriptBlock Log Event ID 4104 with the Get-ADUser filter query. Active Directory query events. Security Event ID 4662 for directory object access on enumerated user objects.
- Test 3Set Reversible Encryption via Fine-Grained Password Policy
Expected signal: Security Event ID 4738/5136 (DS Object Modified): Fine-Grained Password Policy object creation with msDS-PasswordReversibleEncryptionEnabled attribute set. PowerShell ScriptBlock Log Event ID 4104 with New-ADFineGrainedPasswordPolicy.
References (5)
- https://attack.mitre.org/techniques/T1556/005/
- https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption
- https://adsecurity.org/?p=2053
- http://blog.teusink.net/2009/08/passwords-stored-using-reversible.html
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1556.005/T1556.005.md
Unlock Pro Content
Get the full detection package for T1556.005 including response playbook, investigation guide, and atomic red team tests.