Detecting John The Ripper

Rule type:

Correlation

Rule description:

John the Ripper is an open-source offline password cracking tool that is used by both penetration testers and attackers alike to carry out password-related activities. The tool identifies weak passwords and cracks the password hashes using various techniques like brute-force and dictionary attack.

Impact:

It can be used by adversaries in the following ways:

• Password hash cracking
• Credential theft
• Privelege escalation
• Lateral movement

Data source:

Windows:

Required configuration: The rules is based on the process creation and termination. Prerequisites required are installing and configuring Sysmon, enabling audit process creation audit policy, and the command line auditing.

Relevant MITRE ATT&CK techniques and tactics:

Software

Criteria:

(Process name contains john )and Command line contains [bitlocker2john, dmg2john, gpg2john, hccap2john, keepass2john, putty2john, racf2john, rar2john, pdf2john, uaf2john, wpapcap2john, zip2john,kirbi2john, john, john-avx*, john-sse*, john-xop*])

'gpg2john', 'hccap2john', 'keepass2john', 'putty2john', 'racf2john', 'rar2john', 'pdf2john', 'uaf2john', 'wpapcap2john'- These commands are used by attackers while cracking the password through John the Ripper tool from various sources and formats such as PDF, RAR archive files, KeePass database, UNIX authentication file hashes and more.

When to enable this rule:

Enabling this rule will help you meet the security standards' requirements listed below:

Security standards (NIST CSF 2.0):

DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events

When this rule is triggered, you're notified when John The Ripper is being used within the network. This enables you to stop the runtime activity and prevent attacker goals.

PR.PS-05: Installation and execution of unauthorized software are prevented

When this rule is triggered, you're notified when John The Ripper is being used within the network. This enables you to detect the use of unauthorized softwares within the network and prevent credential theft and other attacker goals.

Known false positives: The blue teams might use the tool to test the effectiveness of their defensive measures and incident response protocols.

Next steps:

When this alert is triggered, the following measures can be implemented:

• Identification: Identify the alert as a new incident or within an ongoing incident.
• Analysis: Analyze the impact and extent of the compromise to comprehend the severity of the attack.
• Response: Respond promptly by initiating an automated workflow to cease the malicious process.
• Strong Password Policy Enforcement: Ensure a strong password policy is adhered to across the organization.