PetitPotam Network Share Access Request

name: PetitPotam Network Share Access Request
id: 95b8061a-0a67-11ec-85ec-acde48001122
version: 10
creation_date: '2021-09-01'
modification_date: '2026-05-13'
author: Michael Haag, Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects network share access requests indicative of the PetitPotam attack (CVE-2021-36942). It leverages Windows Event Code 5145, which logs attempts to access network share objects. This detection is significant as PetitPotam can coerce authentication from domain controllers, potentially leading to unauthorized access. If confirmed malicious, this activity could allow attackers to escalate privileges or move laterally within the network, posing a severe security risk. Ensure Event Code 5145 is enabled via Group Policy to utilize this analytic effectively.
data_source:
    - Windows Event Log Security 5145
search: |-
    `wineventlog_security` SubjectUserName="ANONYMOUS LOGON" EventCode=5145 RelativeTargetName=lsarpc
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest, SubjectUserSid, ShareName,
           src, AccessMask, AccessReason
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `petitpotam_network_share_access_request_filter`
how_to_implement: Windows Event Code 5145 is required to utilize this analytic and it may not be enabled in most environments.
known_false_positives: False positives have been limited when the Anonymous Logon is used for Account Name.
references:
    - https://attack.mitre.org/techniques/T1187/
    - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5145
    - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5145
drilldown_searches:
    - name: View the detection results for - "$dest$"
      search: '%original_detection_search% | search  dest = "$dest$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$dest$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: 7d
      latest_offset: "0"
finding:
    title: A remote host is enumerating a $dest$ to identify permissions. This is a precursor event to CVE-2021-36942, PetitPotam.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - PetitPotam NTLM Relay on Active Directory Certificate Services
asset_type: Endpoint
cve:
    - CVE-2021-36942
mitre_attack_id:
    - T1187
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1187/petitpotam/windows-xml.log
          source: XmlWinEventLog:Security
          sourcetype: XmlWinEventLog
      test_type: unit