Detect and prevent NTLM traffic

[Rodrigo_Silva]

Hi everyone,

Is there a way to monitor all NTLM authentication traffic going through my network?

I couldn’t find a way to identify it using HTTPS Inspection.

I need to detect and later enforce a full block on all NTLM authentication traffic.

Has anyone done this before?

[Vincent_Bacher]

Are you using IPS? If yes maybe to compile a snort rule to detect ntlm auth over https would be an idea?

[Rodrigo_Silva]

Yes, I have IPS enabled, but I’ve never worked with Snort rules before. I’ll look into it. Thanks for the tip.

[Rodrigo_Silva · Accepted solution]

Thank you for the tip.

I created the rule below and was able to detect and prevent NTLM traffic using the IPS blade.

alert tcp any any -> any $HTTP_PORTS (msg:"NTLM authentication over TCP"; flow:to_server,established; content:"Authorization|3a|"; nocase; http_header; content:"NTLM"; nocase; distance:0; within:64; http_header; classtype:policy-violation;)

Of course, I also had to enable HTTPS Inspection for the internal network.

Best regards

[Martijn]

Hi,

Can't you use Application Control. There is a Windows NTLM application there.

"Windows Challange/Response (NTLM) is the authentication protocol used on networks that include systems running the Windows operating system on stand-alone systems."

Category: Network Protocols
Risk: Low (2)

Or did you already tried that?

Martijn

[Rodrigo_Silva]

Yes, I already tried it but it didn’t detect anything.