Fake password change detection

Products PingCastle Ideas
, ,
1

What is a one sentence summary of your feature request?

Detecting Fake Active Directory Password Changes

Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.

In Active Directory, there has been a method that’s been around for many years which changes the password last set date but not the actual password. This is what I call a “fake password change” since the account appears to have a recent password when scanning for old passwords based on password last set, but the underlying password hasn’t actually changed.

The method is simply checking and unchecking the “User must change password at next logon” checkbox on an account.

Detection can be done by comparing pwdlastset and the date for unicodepwd as retruned by Get-ADReplicationAttributeMetadata.

Full descripion and method is available here:

and powershell method of detecting the users is available on the github page ActiveDirectory/Get-FakePWChanges.ps1 at main · PyroTek3/ActiveDirectory · GitHub

How do you currently solve the challenges you have by not having this feature?

Manually use the listed powershell script and/or use other scan products like Purple Knight that do have the check build in.

Upload any other supporting files that you think should be considered in this idea.

Get-FakePWChanges.ps1 (2.83 KB)

2 Likes
2

This is a great call for a new risk. We will look to get it added to a future release :slight_smile:

2 Likes
3

We will plan to add this to PingCastle version 4.1

1 Like
4

That will ne a nice addition.

Any idea what the score increase will be? I assume a score per account that matches the condition.

The script allows for 2 modes: admin users or all users: I would suggest by default to check all users, as you don’t really want to have anyone matching this condition, admin or not.

1 thing to keep an eye on: when testing the script linked earlier, we noticed that you have to filter out the accounts that effectively have the “user must change password at next logon” checked, as they they will otherwise show up as a false positive. The pwdlastset attribute will be set to “never” when “user must change password at next logon” is enabled.

5

Thanks for the info, we will make sure to get that tested.

I am not sure on the specifics for scoring yet. We are looking to change our scoring methodology over Q3 in PingCastle to be focused on risk-based scoring and to have bounded limits so we can supply a proper focused score.