Detecting and Mitigating Forced Authentication (T1187)

Forced Authentication (MITRE ATT&CK T1187) is a way to collect credential material by making a user or system send authentication information to a server the attacker controls. MITRE files it under Credential Access and lists Windows as the platform.

The technique rests on a convenience feature. Windows tries to log in for you.

How attackers use it

The Server Message Block (SMB) protocol is common in Windows networks for authentication and file sharing. When a Windows system connects to an SMB resource, it automatically tries to authenticate and sends credential information for the current user to the remote system. That behavior is normal in enterprises, so that users do not have to type credentials to reach network resources.

Web Distributed Authoring and Versioning (WebDAV) is usually used by Windows as a fallback when SMB is blocked or fails. It extends HTTP and typically runs over TCP ports 80 and 443.

An adversary can take advantage of this to obtain user account password hashes. MITRE describes three ways to get a victim's system to reach out:

• A spearphishing attachment with a link to a resource on an external server controlled by the adversary, for example through template injection.
• A specially crafted file placed on a navigation path for privileged accounts, such as an .SCF file on a desktop.
• A crafted file on a publicly accessible share that victims open.

When the system touches the untrusted resource, it tries to authenticate and sends the user's hashed credentials over SMB to the adversary's server. With the hash, the adversary can try offline brute force cracking to recover the plaintext password.

Specifics from MITRE's page: a document with a resource that loads automatically when it opens, using a path like file://remote-address/Normal.dotm; a modified .LNK or .SCF file whose icon filename points to an external location, which forces the system to load the resource whenever the icon is rendered; and abuse of the EfsRpcOpenFileRaw function in the MS-EFSRPC interface to make a victim computer start authentication, which can be used for NTLM relay attacks against other systems on the internal network.

How to detect it

MITRE's detection strategy follows the chain from lure to outbound NTLM:

1. A lure file that references a remote resource (LNK, SCF or an Office template) is created or changed in a place users can reach.
2. A user or the shell accesses or renders it, for instance when icons are listed.
3. The host makes outbound NTLM traffic, over SMB on 139 or 445, or WebDAV on 80 or 443, to an untrusted destination.
4. The same attempts repeat from several users or hosts, or from privileged workstations.

Practical signals: outbound connections to port 445 or 139 that leave your network at all, WebDAV style requests to the internet from workstations, and new .scf or .lnk files on shares and desktops that point to a remote UNC path. File creation events and firewall egress logs cover most of this.

How to reduce the risk

MITRE lists two mitigations.

• Filter network traffic. Block SMB from leaving the enterprise network with egress filtering, or by blocking TCP ports 139 and 445 and UDP port 137. Filter or block WebDAV traffic leaving the network. If access to external resources over SMB or WebDAV is needed, restrict it tightly with allowlisting.
• Use strong password policies. Strong passwords make it harder to crack hashes that are obtained.

Check your own environment

• Does your perimeter firewall block outbound 139, 445 and UDP 137?
• Is outbound WebDAV blocked or allowlisted?
• Are there any .scf files on shared drives or desktops? Do any .lnk files point to remote paths?
• Do your logs show workstations connecting to external IP addresses on port 445?
• Are privileged accounts used on ordinary workstations where a lure file could reach them?
• Do your password rules make cracking a captured hash slow?

Quick check

Sources

• MITRE ATT&CK T1187: Forced Authentication