Skip to content

Commit 05ee579

Browse files
dluxtrondluxtron
committed
adding AD ACL and GPO related detections
1 parent 65e63e4 commit 05ee579

27 files changed

+2966
-24
lines changed

‎detections/application/windows_ad_dangerous_deny_acl_modification.yml

+82
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
name: Windows AD Dangerous Deny ACL Modification
2+
id: 8e897153-2ebd-4cb2-85d3-09ad57db2fb7
3+
version: 1
4+
date: '2023-11-21'
5+
author: Dean Luxton
6+
status: production
7+
type: TTP
8+
data_source:
9+
- Windows Security 5136
10+
description: ACL modification event denying the ability to enumerate permissions.
11+
search: >-
12+
`wineventlog_security` EventCode=5136
13+
| stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId
14+
| rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"
15+
| rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)"
16+
| mvexpand new_ace
17+
| where NOT new_ace IN (old_values)
18+
| rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$"
19+
| rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"
20+
| rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"
21+
| lookup msad_guid_lookup.csv guid as aceObjectGuid OUTPUT displayName as ControlAccessRights
22+
| lookup ace_access_rights_lookup.csv access_rights_string as AccessRights OUTPUT access_rights_value
23+
| lookup ace_type_lookup.csv ace_type_string as aceType OUTPUT ace_type_value as aceType
24+
| lookup ace_flag_lookup.csv flag_string as aceFlags OUTPUT flag_value as ace_flag_value
25+
``` Optional SID resolution lookups
26+
| lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user
27+
| lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ```
28+
| lookup builtin_groups_lookup.csv builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group
29+
| eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid)
30+
| stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID
31+
| eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights')
32+
| search aceType IN ("Access denied",D) AND aceAccessRights IN ("Full control","Read permissions",RC)
33+
| `windows_ad_dangerous_deny_acl_modification_filter`
34+
how_to_implement: See link in references for how to configure logging for these eventcodes. Include lookups for SID resolution if evt_resolve_ad_obj is set to 0.
35+
known_false_positives: None.
36+
references:
37+
- https://happycamper84.medium.com/sneaky-persistence-via-hidden-objects-in-ad-1c91fc37bf54
38+
- https://www.youtube.com/watch?v=_nGpZ1ydzS8
39+
- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
40+
tags:
41+
analytic_story:
42+
- Sneaky Active Directory Persistence Tricks
43+
asset_type: Endpoint
44+
confidence: 100
45+
impact: 100
46+
message: $src_user$ has added ACL rights to deny $user$ $aceControlAccessRights$ $aceAccessRights$ to $ObjectDN$
47+
mitre_attack_id:
48+
- T1484
49+
- T1222
50+
- T1222.001
51+
observable:
52+
- name: user
53+
type: User
54+
role:
55+
- Victim
56+
- name: src_user
57+
type: User
58+
role:
59+
- Victim
60+
product:
61+
- Splunk Enterprise
62+
- Splunk Enterprise Security
63+
- Splunk Cloud
64+
risk_score: 100
65+
required_fields:
66+
- _time
67+
- OperationType
68+
- ObjectDN
69+
- OpCorrelationID
70+
- src_user
71+
- AttributeLDAPDisplayName
72+
- AttributeValue
73+
- ObjectClass
74+
- SubjectLogonId
75+
- DSName
76+
security_domain: endpoint
77+
tests:
78+
- name: True Positive Test
79+
attack_data:
80+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/hidden_object_windows-security-xml.log
81+
source: XmlWinEventLog:Security
82+
sourcetype: xmlwineventlog

‎detections/application/windows_ad_dangerous_group_acl_modification.yml

+83
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
name: Windows AD Dangerous Group ACL Modification
2+
id: 59b0fc85-7a0d-4585-97ec-06a382801990
3+
version: 1
4+
date: '2023-11-13'
5+
author: Dean Luxton
6+
status: production
7+
type: TTP
8+
data_source:
9+
- Windows Security 5136
10+
description: Group ACL modification event with potentially dangerous permissions applied.
11+
search: >-
12+
`wineventlog_security` EventCode=5136 ObjectClass=group
13+
| stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId
14+
| rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"
15+
| rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)"
16+
| mvexpand new_ace
17+
| where NOT new_ace IN (old_values)
18+
| rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$"
19+
| rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"
20+
| rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"
21+
| lookup ace_type_lookup.csv ace_type_string as aceType OUTPUT ace_type_value as aceType
22+
| lookup ace_flag_lookup.csv flag_string as aceFlags OUTPUT flag_value as ace_flag_value
23+
| lookup ace_access_rights_lookup.csv access_rights_string as AccessRights OUTPUT access_rights_value
24+
| lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights
25+
``` Optional SID resolution lookups
26+
| lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user
27+
| lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ```
28+
| lookup builtin_groups_lookup.csv builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group
29+
| eval aceType=coalesce(ace_type_value,aceType), aceInheritance=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)), user=coalesce(user, group, builtin_group, aceSid)
30+
| stats values(aceType) as aceType values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID
31+
| eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights')
32+
| search NOT aceType IN ("*denied*","D","OD","XD") AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP)
33+
| `windows_ad_dangerous_group_acl_modification_filter`
34+
how_to_implement: See link in references for how to configure logging for these eventcodes. Include lookups for SID resolution if evt_resolve_ad_obj is set to 0.
35+
known_false_positives: Unknown
36+
references:
37+
- https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings
38+
- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb
39+
- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a
40+
- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
41+
tags:
42+
analytic_story:
43+
- Sneaky Active Directory Persistence Tricks
44+
asset_type: Endpoint
45+
confidence: 100
46+
impact: 100
47+
message: $src_user$ has added ACL rights to grant $user$ $aceControlAccessRights$ $aceAccessRights$ to group $ObjectDN$
48+
mitre_attack_id:
49+
- T1484
50+
- T1222
51+
- T1222.001
52+
observable:
53+
- name: user
54+
type: User
55+
role:
56+
- Victim
57+
- name: src_user
58+
type: User
59+
role:
60+
- Victim
61+
product:
62+
- Splunk Enterprise
63+
- Splunk Enterprise Security
64+
- Splunk Cloud
65+
risk_score: 100
66+
required_fields:
67+
- _time
68+
- OperationType
69+
- ObjectDN
70+
- OpCorrelationID
71+
- src_user
72+
- AttributeLDAPDisplayName
73+
- AttributeValue
74+
- ObjectClass
75+
- SubjectLogonId
76+
- DSName
77+
security_domain: endpoint
78+
tests:
79+
- name: True Positive Test
80+
attack_data:
81+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/group_dacl_mod_windows-security-xml.log
82+
source: XmlWinEventLog:Security
83+
sourcetype: xmlwineventlog

‎detections/application/windows_ad_dangerous_user_acl_modification.yml

+83
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
name: Windows AD Dangerous User ACL Modification
2+
id: ec5b6790-595a-4fb8-ad43-56e5b55a9617
3+
version: 1
4+
date: '2023-11-15'
5+
author: Dean Luxton
6+
status: production
7+
type: TTP
8+
data_source:
9+
- Windows Security 5136
10+
description: User ACL modification event with potentially dangerous permissions applied.
11+
search: >-
12+
`wineventlog_security` EventCode=5136 ObjectClass=user
13+
| stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId
14+
| rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"
15+
| rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)"
16+
| mvexpand new_ace
17+
| where NOT new_ace IN (old_values)
18+
| rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$"
19+
| rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"
20+
| rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"
21+
| lookup msad_guid_lookup.csv guid as aceObjectGuid OUTPUT displayName as ControlAccessRights
22+
| lookup ace_access_rights_lookup.csv access_rights_string as AccessRights OUTPUT access_rights_value
23+
| lookup ace_type_lookup.csv ace_type_string as aceType OUTPUT ace_type_value as aceType
24+
| lookup ace_flag_lookup.csv flag_string as aceFlags OUTPUT flag_value as ace_flag_value
25+
``` Optional SID resolution lookups
26+
| lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user
27+
| lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ```
28+
| lookup builtin_groups_lookup.csv builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group
29+
| eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid)
30+
| stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID
31+
| eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights')
32+
| search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP)
33+
| `windows_ad_dangerous_user_acl_modification_filter`
34+
how_to_implement: See link in references for how to configure logging for these eventcodes. Include lookups for SID resolution if evt_resolve_ad_obj is set to 0.
35+
known_false_positives: Unknown
36+
references:
37+
- https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings
38+
- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb
39+
- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a
40+
- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
41+
tags:
42+
analytic_story:
43+
- Sneaky Active Directory Persistence Tricks
44+
asset_type: Endpoint
45+
confidence: 100
46+
impact: 100
47+
message: $src_user$ has added ACL rights to grant $user$ $aceControlAccessRights$ $aceAccessRights$ to user $ObjectDN$
48+
mitre_attack_id:
49+
- T1484
50+
- T1222
51+
- T1222.001
52+
observable:
53+
- name: user
54+
type: User
55+
role:
56+
- Victim
57+
- name: src_user
58+
type: User
59+
role:
60+
- Victim
61+
product:
62+
- Splunk Enterprise
63+
- Splunk Enterprise Security
64+
- Splunk Cloud
65+
risk_score: 100
66+
required_fields:
67+
- _time
68+
- OperationType
69+
- ObjectDN
70+
- OpCorrelationID
71+
- src_user
72+
- AttributeLDAPDisplayName
73+
- AttributeValue
74+
- ObjectClass
75+
- SubjectLogonId
76+
- DSName
77+
security_domain: endpoint
78+
tests:
79+
- name: True Positive Test
80+
attack_data:
81+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/user_dacl_mod_windows-security-xml.log
82+
source: XmlWinEventLog:Security
83+
sourcetype: xmlwineventlog

‎detections/application/windows_ad_dcshadow_privileges_acl_addition.yml

+85
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
name: Windows AD DCShadow ACL Addition
2+
id: ae915743-1aa8-4a94-975c-8062ebc8b723
3+
version: 1
4+
date: '2023-11-10'
5+
author: Dean Luxton
6+
status: production
7+
type: TTP
8+
data_source:
9+
- Windows Security 5136
10+
description: Detect ACL modification event applying the minimum required extended rights to perform a DCShadow attack.
11+
search: >-
12+
`wineventlog_security` EventCode=5136 ObjectClass=domainDNS
13+
| stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId
14+
| rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)"
15+
| rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)"
16+
| mvexpand new_ace
17+
| where NOT new_ace IN (old_values)
18+
| rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);;(?P<aceSid>.*?)$"
19+
| search aceObjectGuid IN ("9923a32a-3607-11d2-b9be-0000f87a36b2","1131f6ab-9c07-11d1-f79f-00c04fc2dcd2","1131f6ac-9c07-11d1-f79f-00c04fc2dcd2")
20+
| rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})"
21+
| rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})"
22+
| lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights
23+
| lookup ace_access_rights_lookup.csv access_rights_string as AccessRights OUTPUT access_rights_value
24+
| lookup ace_type_lookup.csv ace_type_string as aceType OUTPUT ace_type_value
25+
| lookup ace_flag_lookup.csv flag_string as aceFlags OUTPUT flag_value as ace_flag_value
26+
``` Optional SID resolution lookups
27+
| lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user
28+
| lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ```
29+
| lookup builtin_groups_lookup.csv builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group
30+
| eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid)
31+
| stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user user
32+
| search (aceControlAccessRights="DS-Install-Replica" AND aceControlAccessRights="DS-Replication-Manage-Topology" AND aceControlAccessRights="DS-Replication-Synchronize") OR (aceControlAccessRights="9923a32a-3607-11d2-b9be-0000f87a36b2" AND aceControlAccessRights="1131f6ab-9c07-11d1-f79f-00c04fc2dcd2" AND aceControlAccessRights="1131f6ac-9c07-11d1-f79f-00c04fc2dcd2")
33+
| `windows_ad_dcshadow_acl_addition_filter`
34+
how_to_implement: See link in references for how to configure logging for these eventcodes.
35+
known_false_positives: Unknown
36+
references:
37+
- https://www.labofapenetrationtester.com/2018/04/dcshadow.html
38+
- https://github.com/samratashok/nishang/blob/master/ActiveDirectory/Set-DCShadowPermissions.ps1
39+
- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a
40+
- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
41+
tags:
42+
analytic_story:
43+
- Sneaky Active Directory Persistence Tricks
44+
asset_type: Endpoint
45+
confidence: 100
46+
impact: 100
47+
message: $targetDomain$ ACL modification Event Initiated by $src_user$ applying $user$ the minimum required extended rights to perform a DCShadow attack.
48+
mitre_attack_id:
49+
- T1484
50+
- T1207
51+
- T1222.001
52+
observable:
53+
- name: user
54+
type: User
55+
role:
56+
- Victim
57+
- name: src_user
58+
type: User
59+
role:
60+
- Victim
61+
- name: src_ip
62+
type: Hostname
63+
role:
64+
- Victim
65+
product:
66+
- Splunk Enterprise
67+
- Splunk Enterprise Security
68+
- Splunk Cloud
69+
risk_score: 100
70+
required_fields:
71+
- _time
72+
- OperationType
73+
- src_user
74+
- AttributeLDAPDisplayName
75+
- AttributeValue
76+
- ObjectClass
77+
- SubjectLogonId
78+
- DSName
79+
security_domain: endpoint
80+
tests:
81+
- name: True Positive Test
82+
attack_data:
83+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/DCShadowPermissions/windows-security-xml.log
84+
source: XmlWinEventLog:Security
85+
sourcetype: xmlwineventlog

0 commit comments

Comments
 (0)