Skip to content

Commit 0eea327

Browse files
v-atulyadavv-atulyadav
authored
Merge pull request #14688 from VAsHachiRoku/master
Add Microsoft Active Directory Tier Model solution
2 parents f531d7b + 44ad298 commit 0eea327

38 files changed

Lines changed: 7094 additions & 0 deletions

File tree

‎Logos/MicrosoftADTierModel.svg‎

Lines changed: 15 additions & 0 deletions
Loading

‎Solutions/Microsoft Active Directory Tier Model/Analytic Rules/TM001_GROUPAddedToGroupOutsideTheObjectTierLevel.yaml‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
id: b300c7f8-dc5e-4fc6-879b-63f0013358ce
2+
name: 'PROD (TM001.1) - GROUP - Added to Group Outside the Object Tier Level'
3+
description: |
4+
Added an object to a member of a Tier Model group that is outside of the same Tier. Example a Tier 0 user added to a Tier 1 group.
5+
severity: High
6+
requiredDataConnectors:
7+
- connectorId: SecurityEvents
8+
dataTypes:
9+
- SecurityEvent
10+
- connectorId: WindowsSecurityEvents
11+
dataTypes:
12+
- SecurityEvent
13+
queryFrequency: 5m
14+
queryPeriod: 5m
15+
triggerOperator: gt
16+
triggerThreshold: 0
17+
status: Available
18+
tactics:
19+
- PrivilegeEscalation
20+
relevantTechniques:
21+
- T1078.002
22+
query: |
23+
SecurityEvent
24+
| where EventID == 5136
25+
and Activity has "modified"
26+
and (EventData matches regex @"(?i)OU=Tier 0 Accounts"
27+
or EventData matches regex @"(?i)OU=Tier 1 Accounts"
28+
or EventData matches regex @"(?i)OU=Tier 2 Accounts"
29+
or EventData matches regex @"(?i)OU=Tier 0 Service Accounts"
30+
or EventData matches regex @"(?i)OU=Tier 1 Service Accounts"
31+
or EventData matches regex @"(?i)OU=Tier 2 Service Accounts"
32+
or EventData matches regex @"(?i)OU=Tier 0 Groups"
33+
or EventData matches regex @"(?i)OU=Tier 1 Groups"
34+
or EventData matches regex @"(?i)OU=Tier 2 Groups"
35+
or EventData matches regex @"(?i)OU=Tier 0 PAW"
36+
or EventData matches regex @"(?i)OU=Tier 1 PAW"
37+
or EventData matches regex @"(?i)OU=Tier 2 PAW")
38+
and EventData has '"AttributeLDAPDisplayName">member'
39+
and EventData has 'OperationType">%%14674'
40+
| extend GroupName_e = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
41+
| extend GroupName = extract("(?i)CN=([^,]+)", 1, GroupName_e)
42+
| where GroupName != "Protected Users"
43+
| where GroupName != "Allowed RODC Password Replication Group"
44+
| extend GroupTier_e = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
45+
| extend GroupTier = extract("(?i)OU=(Tier [^ ]+)", 1, GroupTier_e)
46+
| extend GroupTier = iff(isempty(GroupTier), "Outside Tier Model", GroupTier)
47+
| extend ObjectName_e = extract("<Data Name=\"AttributeValue\">([^<]+)</Data>", 1, EventData)
48+
| extend ObjectName = extract("(?i)CN=([^,]+)", 1, ObjectName_e)
49+
| extend ObjectTier_e = extract("<Data Name=\"AttributeValue\">([^<]+)</Data>", 1, EventData)
50+
| extend ObjectTier = extract("(?i)OU=(Tier [^ ]+)", 1, ObjectTier_e)
51+
| extend ObjectTier = iff(isempty(ObjectTier), "Outside Tier Model", ObjectTier)
52+
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
53+
| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
54+
| extend OperationType = iff(EventData has 'OperationType">%%14674', "Added", tostring(OperationType))
55+
| where GroupTier != ObjectTier
56+
| project TimeGenerated
57+
, ObjectName
58+
, ObjectTier
59+
, ObjectType = AccountType
60+
, GroupName
61+
, GroupTier
62+
, ActivityType
63+
, OperationType
64+
, Account
65+
, Domain
66+
, Computer
67+
, Channel
68+
, EventID
69+
, EventData
70+
entityMappings:
71+
- entityType: Account
72+
fieldMappings:
73+
- identifier: FullName
74+
columnName: ObjectName
75+
- entityType: SecurityGroup
76+
fieldMappings:
77+
- identifier: DistinguishedName
78+
columnName: GroupName
79+
- entityType: Account
80+
fieldMappings:
81+
- identifier: FullName
82+
columnName: Account
83+
- entityType: Host
84+
fieldMappings:
85+
- identifier: HostName
86+
columnName: Computer
87+
customDetails:
88+
ObjectName: ObjectName
89+
ObjectTier: ObjectTier
90+
ObjectType: ObjectType
91+
GroupName: GroupName
92+
GroupTier: GroupTier
93+
ActivityType: ActivityType
94+
OperationType: OperationType
95+
Account: Account
96+
Domain: Domain
97+
Channel: Channel
98+
EventID: EventID
99+
EventData: EventData
100+
eventGroupingSettings:
101+
aggregationKind: AlertPerResult
102+
incidentConfiguration:
103+
createIncident: true
104+
groupingConfiguration:
105+
enabled: false
106+
reopenClosedIncident: false
107+
lookbackDuration: PT5M
108+
matchingMethod: Selected
109+
groupByEntities:
110+
- Account
111+
groupByCustomDetails:
112+
- ObjectName
113+
alertDetailsOverride:
114+
alertDisplayNameFormat: '(TM001.1) A {{ObjectTier}} object was added to non-{{ObjectTier}} group {{GroupName}}'
115+
alertDescriptionFormat: |
116+
Tier Model Alert TM001 - A {{ObjectTier}} object was added to non-{{ObjectTier}} group {{GroupName}}.
117+
118+
Resolution - Remove the object from the group
119+
version: 1.0.0
120+
kind: Scheduled

‎Solutions/Microsoft Active Directory Tier Model/Analytic Rules/TM002_OBJECTCreatedOrDeletedATierLevelObject.yaml‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
id: b58adf25-fb44-4296-9b6c-0e6b97139dad
2+
name: 'PROD (TM002.1) - OBJECT - Created or Deleted a Tier Level Object'
3+
description: |
4+
A Tier Model object was created or deleted
5+
severity: Low
6+
requiredDataConnectors:
7+
- connectorId: SecurityEvents
8+
dataTypes:
9+
- SecurityEvent
10+
- connectorId: WindowsSecurityEvents
11+
dataTypes:
12+
- SecurityEvent
13+
queryFrequency: 30m
14+
queryPeriod: 30m
15+
triggerOperator: gt
16+
triggerThreshold: 0
17+
status: Available
18+
tactics:
19+
- InitialAccess
20+
relevantTechniques:
21+
- T1078.002
22+
query: |
23+
SecurityEvent
24+
| where (EventID == 5137
25+
or EventID == 5141)
26+
and (EventData matches regex @"(?i)OU=Domain Controllers"
27+
or EventData matches regex @"(?i)OU=Tier 0 Accounts"
28+
or EventData matches regex @"(?i)OU=Tier 1 Accounts"
29+
or EventData matches regex @"(?i)OU=Tier 2 Accounts"
30+
or EventData matches regex @"(?i)OU=Tier 0 Service Accounts"
31+
or EventData matches regex @"(?i)OU=Tier 1 Service Accounts"
32+
or EventData matches regex @"(?i)OU=Tier 2 Service Accounts"
33+
or EventData matches regex @"(?i)OU=Tier 0 Groups"
34+
or EventData matches regex @"(?i)OU=Tier 1 Groups"
35+
or EventData matches regex @"(?i)OU=Tier 2 Groups"
36+
or EventData matches regex @"(?i)OU=Tier 0 PAW"
37+
or EventData matches regex @"(?i)OU=Tier 1 PAW"
38+
or EventData matches regex @"(?i)OU=Tier 2 PAW"
39+
or EventData matches regex @"(?i)OU=Tier 0 Member Servers"
40+
or EventData matches regex @"(?i)OU=Tier 1 Member Servers"
41+
or EventData matches regex @"(?i)CN=Builtin"
42+
or EventData matches regex @"(?i)CN=Computers"
43+
or EventData matches regex @"(?i)CN=Users")
44+
| extend ObjectName_e = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
45+
| extend ObjectName = extract("(?i)CN=([^,]+)", 1, ObjectName_e)
46+
| extend ObjectTier_e = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
47+
| extend ObjectTier = extract("(?i)OU=(Tier [^ ,]+)", 1, ObjectTier_e)
48+
| extend ObjectTier = iff(ObjectTier == "", "Outside Tier Model", ObjectTier)
49+
| extend ObjectTier = iff(ObjectTier_e has "OU=Domain Controllers", "Tier 0", ObjectTier)
50+
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
51+
| where ObjectClass !has "organizationalUnit" and ObjectClass !has "msFVE-RecoveryInformation"
52+
| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
53+
| extend SubjectUserName = extract("<Data Name=\"SubjectUserName\">([^<]+)</Data>", 1, EventData)
54+
| extend SubjectDomainName = extract("<Data Name=\"SubjectDomainName\">([^<]+)</Data>", 1, EventData)
55+
| extend Account = strcat(SubjectDomainName, "\\", SubjectUserName)
56+
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
57+
| project TimeGenerated
58+
, ObjectName
59+
, ObjectTier
60+
, ObjectClass
61+
, ActivityType
62+
, Account
63+
, Domain
64+
, Computer
65+
, Channel
66+
, EventID
67+
, EventData
68+
entityMappings:
69+
- entityType: Account
70+
fieldMappings:
71+
- identifier: FullName
72+
columnName: ObjectName
73+
- entityType: Host
74+
fieldMappings:
75+
- identifier: HostName
76+
columnName: Computer
77+
- entityType: Account
78+
fieldMappings:
79+
- identifier: FullName
80+
columnName: Account
81+
customDetails:
82+
ObjectName: ObjectName
83+
ObjectTier: ObjectTier
84+
ObjectClass: ObjectClass
85+
ActivityType: ActivityType
86+
Account: Account
87+
Domain: Domain
88+
Computer: Computer
89+
Channel: Channel
90+
EventID: EventID
91+
EventData: EventData
92+
eventGroupingSettings:
93+
aggregationKind: AlertPerResult
94+
incidentConfiguration:
95+
createIncident: true
96+
groupingConfiguration:
97+
enabled: false
98+
reopenClosedIncident: false
99+
lookbackDuration: PT5M
100+
matchingMethod: Selected
101+
groupByEntities:
102+
- Account
103+
groupByCustomDetails:
104+
- ObjectName
105+
alertDetailsOverride:
106+
alertDisplayNameFormat: '(TM002.1) A {{ObjectTier}} {{ObjectClass}} was {{ActivityType}}'
107+
alertDescriptionFormat: 'Tier Model TM002 - A Tier Model object was created or deleted.'
108+
version: 1.0.0
109+
kind: Scheduled

‎Solutions/Microsoft Active Directory Tier Model/Analytic Rules/TM003_OBJECTMovedOrRecoveredATierLevelAccount.yaml‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
id: 1d858e12-777d-4156-b0af-b5ef410739e6
2+
name: 'PROD (TM003.1) - OBJECT - Moved or Recovered a Tier Level Account'
3+
description: |
4+
Moving or Recovering of a Tier Model object.
5+
severity: Medium
6+
requiredDataConnectors:
7+
- connectorId: SecurityEvents
8+
dataTypes:
9+
- SecurityEvent
10+
- connectorId: WindowsSecurityEvents
11+
dataTypes:
12+
- SecurityEvent
13+
queryFrequency: 30m
14+
queryPeriod: 30m
15+
triggerOperator: gt
16+
triggerThreshold: 0
17+
status: Available
18+
tactics:
19+
- Persistence
20+
relevantTechniques:
21+
- T1078.002
22+
query: |
23+
SecurityEvent
24+
| where (EventID == 5138
25+
or EventID == 5139)
26+
and (EventData matches regex @"(?i)OU=Domain Controllers"
27+
or EventData matches regex @"(?i)OU=Tier 0 Accounts"
28+
or EventData matches regex @"(?i)OU=Tier 1 Accounts"
29+
or EventData matches regex @"(?i)OU=Tier 2 Accounts"
30+
or EventData matches regex @"(?i)OU=Tier 0 Service Accounts"
31+
or EventData matches regex @"(?i)OU=Tier 1 Service Accounts"
32+
or EventData matches regex @"(?i)OU=Tier 2 Service Accounts"
33+
or EventData matches regex @"(?i)OU=Tier 0 Groups"
34+
or EventData matches regex @"(?i)OU=Tier 1 Groups"
35+
or EventData matches regex @"(?i)OU=Tier 2 Groups"
36+
or EventData matches regex @"(?i)OU=Tier 0 PAW"
37+
or EventData matches regex @"(?i)OU=Tier 1 PAW"
38+
or EventData matches regex @"(?i)OU=Tier 2 PAW"
39+
or EventData matches regex @"(?i)OU=Tier 0 Member Servers"
40+
or EventData matches regex @"(?i)OU=Tier 1 Member Servers")
41+
| extend OldObject_e = extract("<Data Name=\"OldObjectDN\">([^<]+)</Data>", 1, EventData)
42+
| extend OldObject = extract("(?i)CN=([^,]+)", 1, OldObject_e)
43+
| extend OldObjectTier = extract("(?i)OU=(Tier [^ ]+)", 1, OldObject_e)
44+
| extend OldObjectTier = iff(isempty(OldObjectTier), "Outside Tier Model", OldObjectTier)
45+
| extend NewObject_e = extract("<Data Name=\"NewObjectDN\">([^<]+)</Data>", 1, EventData)
46+
| extend NewObject = extract("(?i)CN=([^,]+)", 1, NewObject_e)
47+
| extend NewObjectTier = extract("(?i)OU=(Tier [^ ]+)", 1, NewObject_e)
48+
| extend SubjectUserName = extract("<Data Name=\"SubjectUserName\">([^<]+)</Data>", 1, EventData)
49+
| extend SubjectDomainName = extract("<Data Name=\"SubjectDomainName\">([^<]+)</Data>", 1, EventData)
50+
| extend Account = strcat(SubjectDomainName, "\\", SubjectUserName)
51+
| extend NewObjectTier = iff(isempty(NewObjectTier),
52+
iff(NewObject_e matches regex @"(?i)OU=Domain Controllers", "Tier 0", "Outside Tier Model"),
53+
NewObjectTier)
54+
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
55+
| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
56+
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
57+
| where OldObject != NewObjectTier
58+
| project TimeGenerated
59+
, ObjectName = OldObject
60+
, NewObjectTier
61+
, NewObjectOU = NewObject_e
62+
, ObjectClass
63+
, PreviousTier = OldObjectTier
64+
, PreviousOU = OldObject_e
65+
, ActivityType
66+
, Account
67+
, Domain
68+
, Computer
69+
, Channel
70+
, EventID
71+
, EventData
72+
entityMappings:
73+
- entityType: Account
74+
fieldMappings:
75+
- identifier: FullName
76+
columnName: ObjectName
77+
- entityType: Host
78+
fieldMappings:
79+
- identifier: HostName
80+
columnName: Computer
81+
- entityType: Account
82+
fieldMappings:
83+
- identifier: FullName
84+
columnName: Account
85+
customDetails:
86+
ObjectName: ObjectName
87+
NewObjectTier: NewObjectTier
88+
NewObjectOU: NewObjectOU
89+
ObjectClass: ObjectClass
90+
PreviousTier: PreviousTier
91+
PreviousOU: PreviousOU
92+
ActivityType: ActivityType
93+
Account: Account
94+
Domain: Domain
95+
Computer: Computer
96+
Channel: Channel
97+
EventID: EventID
98+
EventData: EventData
99+
eventGroupingSettings:
100+
aggregationKind: AlertPerResult
101+
incidentConfiguration:
102+
createIncident: true
103+
groupingConfiguration:
104+
enabled: false
105+
reopenClosedIncident: false
106+
lookbackDuration: PT5H
107+
matchingMethod: AllEntities
108+
alertDetailsOverride:
109+
alertDisplayNameFormat: '(TM003.1) A {{NewObjectTier}} {{ObjectClass}} was {{ActivityType}}'
110+
alertDescriptionFormat: '{{ObjectName}} was moved from {{PreviousOU}} to the following OU {{NewObjectOU}}.'
111+
version: 1.0.0
112+
kind: Scheduled

0 commit comments

Comments
 (0)