From d973e001a069885b57db0d903af5934ce1d51c04 Mon Sep 17 00:00:00 2001 From: ljstella Date: Mon, 5 May 2025 09:14:39 -0500 Subject: [PATCH] Removing duplicate group-by field --- ...t_initiated_from_unsanctioned_location.yml | 94 ++++++++++--------- 1 file changed, 50 insertions(+), 44 deletions(-) diff --git a/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml b/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml index 93371cf3da..c74d9698e0 100644 --- a/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml +++ b/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml @@ -1,14 +1,15 @@ name: Windows AD Replication Request Initiated from Unsanctioned Location id: 50998483-bb15-457b-a870-965080d9e3d3 -version: 10 -date: '2025-03-27' +version: 11 +date: '2025-05-05' author: Dean Luxton type: TTP status: production data_source: -- Windows Event Log Security 4662 -- Windows Event Log Security 4624 -description: The following analytic identifies unauthorized Active Directory replication + - Windows Event Log Security 4662 + - Windows Event Log Security 4624 +description: + The following analytic identifies unauthorized Active Directory replication requests initiated from non-domain controller locations. It leverages EventCode 4662 to detect when a computer account with replication permissions creates a handle to domainDNS, filtering out known domain controller IP addresses. This activity @@ -16,7 +17,8 @@ description: The following analytic identifies unauthorized Active Directory rep access can request password hashes for any or all users within the domain. If confirmed malicious, this could lead to unauthorized access to sensitive information and potential full domain compromise. -search: '`wineventlog_security` EventCode=4662 ObjectType IN ("%{19195a5b-6da0-11d0-afd3-00c04fd930c9}", +search: + '`wineventlog_security` EventCode=4662 ObjectType IN ("%{19195a5b-6da0-11d0-afd3-00c04fd930c9}", "domainDNS") AND Properties IN ("*Replicating Directory Changes All*", "*{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}*", "*{9923a32a-3607-11d2-b9be-0000f87a36b2}*","*{1131f6ac-9c07-11d1-f79f-00c04fc2dcd2}*") AND AccessMask="0x100" AND (SubjectUserSid="NT AUT*" OR SubjectUserSid="S-1-5-18" @@ -24,7 +26,7 @@ search: '`wineventlog_security` EventCode=4662 ObjectType IN ("%{19195a5b-6da0-1 as attack_time, count by SubjectDomainName SubjectUserName Computer Logon_ID ObjectName ObjectServer ObjectType OperationType status action app authentication_method dest dvc process process_id process_name process_path signature signature_id src src_port - status subject user user_group vendor_product | rename SubjectDomainName as Target_Domain, + subject user user_group vendor_product | rename SubjectDomainName as Target_Domain, SubjectUserName as user, Logon_ID as TargetLogonId | appendpipe [| map search="search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$"] | table attack_time, AuthenticationPackageName, LogonProcessName, LogonType, TargetUserSid, Target_Domain, @@ -34,7 +36,8 @@ search: '`wineventlog_security` EventCode=4662 ObjectType IN ("%{19195a5b-6da0-1 values(Computer) as Computer, values(status) as status, values(src_category) as src_category, values(src_ip) as src_ip by TargetLogonId | search NOT src_category="domain_controller" | `windows_ad_replication_request_initiated_from_unsanctioned_location_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting +how_to_implement: + To successfully implement this search, you need to be ingesting eventcode `4662`. The Advanced Security Audit policy settings `Audit Directory Services Access` within `DS Access` needs to be enabled, as well as the following SACLs applied to the domain root and all descendant objects. The principals `everybody`, `Domain @@ -44,52 +47,55 @@ how_to_implement: To successfully implement this search, you need to be ingestin category of domain_controller added for domain controllers. known_false_positives: Genuine DC promotion may trigger this alert. references: -- https://adsecurity.org/?p=1729 -- https://www.linkedin.com/pulse/mimikatz-dcsync-event-log-detections-john-dwyer -- https://github.com/SigmaHQ/sigma/blob/0.22-699-g29a5c6278/rules/windows/builtin/security/win_security_dcsync.yml + - https://adsecurity.org/?p=1729 + - https://www.linkedin.com/pulse/mimikatz-dcsync-event-log-detections-john-dwyer + - https://github.com/SigmaHQ/sigma/blob/0.22-699-g29a5c6278/rules/windows/builtin/security/win_security_dcsync.yml drilldown_searches: -- name: View the detection results for - "$user$" - search: '%original_detection_search% | search user = "$user$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ + - name: View the detection results for - "$user$" + search: '%original_detection_search% | search user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" + search: + '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ rba: - message: Windows Active Directory Replication Request Initiated from Unsanctioned + message: + Windows Active Directory Replication Request Initiated from Unsanctioned Location $src_ip$ by $user$ risk_objects: - - field: user - type: user - score: 100 - - field: src_ip - type: system - score: 100 + - field: user + type: user + score: 100 + - field: src_ip + type: system + score: 100 threat_objects: [] tags: analytic_story: - - Compromised Windows Host - - Sneaky Active Directory Persistence Tricks - - Credential Dumping + - Compromised Windows Host + - Sneaky Active Directory Persistence Tricks + - Credential Dumping asset_type: Endpoint mitre_attack_id: - - T1003.006 + - T1003.006 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud security_domain: endpoint - manual_test: This detection runs correctly when run manually and given some time + manual_test: + This detection runs correctly when run manually and given some time is given for data to settle in the splunk index. tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.006/impacket/windows-security-xml.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.006/impacket/windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog