Updating DCSync and Dcshadow Detections, adding another SID History detection, renames and updates

detections/endpoint/dcsync_attack.yml

@@ -1,88 +0,0 @@
-name: DCSync Attack
-id: 51307514-1236-49f6-8686-d46d93cc2821
-version: 1
-date: '2022-09-08'
-author: Dean Luxton
-type: TTP
-datamodel: []
-description: When a domain controller receives a replication request, the user account permissions are validated, however no checks are performed to validate the request was initiated by a Domain Controller.
- Once an attacker gains control of an account with the necessary privileges, they can request password hashes for any or all users within the domain.
- This alert detects when a handle to domainDNS is opened with the necessary replication permissions. 
-search: '`wineventlog_security` EventCode=4662 ObjectType IN ("%{19195a5b-6da0-11d0-afd3-00c04fd930c9}",
-  "domainDNS") AND Properties IN ("*Replicating Directory Changes All*", "*{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}*",
-  "*{9923a32a-3607-11d2-b9be-0000f87a36b2}*","*{1131f6ac-9c07-11d1-f79f-00c04fc2dcd2}*")
-  | stats min(_time) as firstEvent, max(_time) as latestEvent, range(_time) as duration
-  count by AccessMask, SubjectDomainName, SubjectUserName, Computer, Logon_ID, ObjectName,
-  ObjectServer, ObjectType, OperationType, status
-  | join type=outer Logon_ID [| search `wineventlog_security` EventCode=4624 | rename
-  TargetLogonId as Logon_ID, TargetDomainName as domain]
-  | table firstEvent, latestEvent, duration, AccessMask, domain, user, Computer, Logon_ID,
-  ObjectName, ObjectServer, ObjectType, OperationType, status, src_ip, Logon_ID
-  | eval firstEvent=strftime(firstEvent, "%Y-%m-%d %H:%M:%S"), latestEvent=strftime(latestEvent,
-  "%Y-%m-%d %H:%M:%S") | `dcsync_attack_filter`'
-how_to_implement: To successfully implement this search, you ned to be ingesting eventcode `4662`. 
- The Advanced Security Audit policy settings `Audit Directory Services Access`
- within `DS Access` needs to be enabled, as well as the following SACLs applied to the domain root 
- and all descendant objects. The principals `everybody`,  `Domain Computers`, and  `Domain Controllers`
- auditing the permissions `Replicating Directory Changes`, `Replicating Directory Changes All`, and 
- `Replicating Directory Changes In Filtered Set`
- If genuine DC activity triggers this detection within your environment, look to tune out the 
- domain controller computer accounts using asset and identities.   
-known_false_positives: A genuine domain controller promotion event will trigger this alert. 
-references:
-- https://adsecurity.org/?p=1729
-- https://www.linkedin.com/pulse/mimikatz-dcsync-event-log-detections-john-dwyer
-tags:
-  analytic_story:
-  - Windows Domain Controller Attacks
-  - Credential Dumping
-  asset_type: Endpoint
-  cis20:
-  - CIS 4
-  - CIS 6
-  confidence: 80
-  context:
-    - Source:Endpoint
-    - Source:AD
-    - Stage:Credential Access
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.006/impacket/windows-security-xml.log
-  impact: 100
-  kill_chain_phases:
-  - Actions on Objectives
-  message: DCSync Attack Detected from $src$
-  mitre_attack_id:
-  - T1003.006
-  - T1003
-  nist:
-  - DE.CM
-  observable:
-  - name: src_user
-    type: User
-    role:
-    - Victim
-  - name: src
-    type: IP Address
-    role:
-    - Attacker
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - EventCode
-  - ObjectType
-  - Properties
-  - AccessMask
-  - SubjectDomainName
-  - SubjectUserName
-  - Computer
-  - Logon_ID
-  - ObjectName
-  - ObjectServer
-  - ObjectType
-  - OperationType
-  - status
-  risk_score: 80
-  security_domain: endpoint

detections/endpoint/windows_active_directory_replication_request_initiated_by_user_account.yml

@@ -0,0 +1,84 @@
+name: Windows Active Directory Replication Request Initiated by User Account
+id: 51307514-1236-49f6-8686-d46d93cc2821
+version: 1
+date: '2022-09-08'
+author: Dean Luxton
+type: TTP
+datamodel: []
+description: This alert was written to detect activity associated with the DCSync attack. 
+ When a domain controller receives a replication request, the user account permissions are validated, however no checks are performed to validate the request was initiated by a Domain Controller.
+ Once an attacker gains control of an account with the necessary privileges, they can request password hashes for any or all users within the domain.
+ This alert detects when a user account creates a handle to domainDNS with the necessary replication permissions. 
+search: '`wineventlog_security` EventCode=4662 ObjectType IN ("%{19195a5b-6da0-11d0-afd3-00c04fd930c9}", "domainDNS") AND Properties IN ("*Replicating Directory Changes All*", "*{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}*", "*{9923a32a-3607-11d2-b9be-0000f87a36b2}*","*{1131f6ac-9c07-11d1-f79f-00c04fc2dcd2}*") AND AccessMask="0x100" AND NOT (SubjectUserSid="NT AUT*" OR SubjectUserSid="S-1-5-18" OR SubjectDomainName="Window Manager" OR SubjectUserName="*$")
+ | stats min(_time) as _time, count by SubjectDomainName, SubjectUserName, Computer, Logon_ID, ObjectName, ObjectServer, ObjectType, OperationType, status
+ | rename SubjectDomainName as Target_Domain, SubjectUserName as user, Logon_ID as TargetLogonId, _time as attack_time
+ | appendpipe [| map search="search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$"]
+ | table attack_time, AuthenticationPackageName, LogonProcessName, LogonType, TargetUserSid, Target_Domain, user, Computer, TargetLogonId, status, src_ip, src_category, ObjectName, ObjectServer, ObjectType, OperationType
+ | stats min(attack_time) as _time values(TargetUserSid) as TargetUserSid, values(Target_Domain) as Target_Domain, values(user) as user, values(Computer) as Computer, values(status) as status, values(src_category) as src_category, values(src_ip) as src_ip by TargetLogonId
+ | `windows_active_directory_replication_request_initiated_by_user_account_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting eventcode `4662`. 
+ The Advanced Security Audit policy settings `Audit Directory Services Access`
+ within `DS Access` needs to be enabled, as well as the following SACLs applied to the domain root 
+ and all descendant objects. The principals `everybody`,  `Domain Computers`, and  `Domain Controllers`
+ auditing the permissions `Replicating Directory Changes`, `Replicating Directory Changes All`, and 
+ `Replicating Directory Changes In Filtered Set`
+known_false_positives: Azure AD Connect syncing operations. 
+references:
+- https://adsecurity.org/?p=1729
+- https://www.linkedin.com/pulse/mimikatz-dcsync-event-log-detections-john-dwyer
+- https://github.com/SigmaHQ/sigma/blob/0.22-699-g29a5c6278/rules/windows/builtin/security/win_security_dcsync.yml
+tags:
+  analytic_story:
+  - Windows Domain Controller Attacks
+  - Credential Dumping
+  asset_type: Endpoint
+  cis20:
+  - CIS 4
+  - CIS 6
+  confidence: 100
+  context:
+    - Source:Endpoint
+    - Source:AD
+    - Stage:Credential Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.006/impacket/windows-security-xml.log
+  impact: 100
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Windows Active Directory Replication Request Initiated by User Account $user$ at $src_ip$
+  mitre_attack_id:
+  - T1003.006
+  - T1003
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - ObjectType
+  - Properties
+  - AccessMask
+  - SubjectDomainName
+  - SubjectUserName
+  - SubjectUserSid
+  - Computer
+  - Logon_ID
+  - ObjectName
+  - ObjectServer
+  - ObjectType
+  - OperationType
+  - status
+  risk_score: 100
+  security_domain: endpoint

detections/endpoint/windows_active_directory_replication_request_initiated_from_unsanctioned_location.yml

@@ -0,0 +1,101 @@
+name: Windows Active Directory Replication Request Initiated from Unsanctioned Location
+id: 50998483-bb15-457b-a870-965080d9e3d3
+version: 1
+date: '2022-11-17'
+author: Dean Luxton
+type: TTP
+datamodel: []
+description: This alert was written to detect activity associated with the DCSync attack.
+ When a domain controller receives a replication request, the user account permissions are validated, however no checks are performed to validate the request was initiated by a Domain Controller.
+ Once an attacker gains control of an account with the necessary privileges, they can request password hashes for any or all users within the domain.
+ This alert detects when any AD account creates a handle to domainDNS with the necessary replication permissions. These requests are then filtered to exclude where the events originate 
+ from a known domain controller IP address. Note, this detection is viable for detecting DCSync attacks performed using computer accounts.   
+search: '`wineventlog_security` EventCode=4662 ObjectType IN ("%{19195a5b-6da0-11d0-afd3-00c04fd930c9}",
+  "domainDNS") AND Properties IN ("*Replicating Directory Changes All*", "*{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}*",
+  "*{9923a32a-3607-11d2-b9be-0000f87a36b2}*","*{1131f6ac-9c07-11d1-f79f-00c04fc2dcd2}*")
+  AND AccessMask="0x100" 
+
+  | stats min(_time) as attack_time, count by SubjectDomainName, SubjectUserName,
+  Computer, Logon_ID, ObjectName, ObjectServer, ObjectType, OperationType, status
+
+  | rename SubjectDomainName as Target_Domain, SubjectUserName as user, Logon_ID as
+  TargetLogonId
+
+  | appendpipe [| map search="search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$"]
+
+  | table attack_time, AuthenticationPackageName, LogonProcessName, LogonType, TargetUserSid,
+  Target_Domain, user, Computer, TargetLogonId, status, src_ip, src_category, ObjectName,
+  ObjectServer, ObjectType, OperationType
+
+  | stats min(attack_time) as _time, values(TargetUserSid) as TargetUserSid, values(Target_Domain)
+  as Target_Domain, values(user) as user, values(Computer) as Computer, values(status)
+  as status, values(src_category) as src_category, values(src_ip) as src_ip by TargetLogonId
+
+  | search NOT src_category="domain_controller" | `windows_active_directory_replication_request_initiated_from_unsanctioned_location_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting eventcode `4662`.
+ The Advanced Security Audit policy settings `Audit Directory Services Access`
+ within `DS Access` needs to be enabled, as well as the following SACLs applied to the domain root
+ and all descendant objects. The principals `everybody`,  `Domain Computers`, and  `Domain Controllers`
+ auditing the permissions `Replicating Directory Changes`, `Replicating Directory Changes All`, and
+ `Replicating Directory Changes In Filtered Set`
+ Assets and Identities will also need to be configured, with the category of domain_controller added for genuine DCs. 
+known_false_positives: Genuine DC promotion may trigger this alert. 
+references:
+- https://adsecurity.org/?p=1729
+- https://www.linkedin.com/pulse/mimikatz-dcsync-event-log-detections-john-dwyer
+- https://github.com/SigmaHQ/sigma/blob/0.22-699-g29a5c6278/rules/windows/builtin/security/win_security_dcsync.yml
+tags:
+  analytic_story:
+  - Windows Domain Controller Attacks
+  - Credential Dumping
+  asset_type: Endpoint
+  cis20:
+  - CIS 4
+  - CIS 6
+  confidence: 100
+  context:
+    - Source:Endpoint
+    - Source:AD
+    - Stage:Credential Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.006/impacket/windows-security-xml.log
+  impact: 100
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Windows Active Directory Replication Request Initiated from Unsanctioned Location $src_ip$ by $user$  
+  mitre_attack_id:
+  - T1003.006
+  - T1003
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - ObjectType
+  - Properties
+  - AccessMask
+  - SubjectDomainName
+  - SubjectUserName
+  - SubjectUserSid
+  - Computer
+  - Logon_ID
+  - ObjectName
+  - ObjectServer
+  - ObjectType
+  - OperationType
+  - status
+  risk_score: 100
+  security_domain: endpoint

detections/endpoint/windows_active_directory_same_domain_sid_history_addition.yml

@@ -1,15 +1,14 @@
-name: Windows Active Directory SID History Abuse
+name: Windows Active Directory Same Domain SID History Addition
 id: 5fde0b7c-df7a-40b1-9b3a-294c00f0289d
 version: 2
 date: '2022-09-09'
 author: Dean Luxton
 type: TTP
 datamodel: []
-description: The following analytic looks for changes to user or computer objects where the SID History attribute has been modified.
- The SID history AD attribute allows users to inherit permissions from a separate AD account by updating its AD attribute and setting it too the privileged users SID. Initially developed for access 
- continuity when migrating domains, this attribute can also be applied for two objects within the same domain. 
- Red teamers and adersaries alike who have obtained privileged access within an Active Directory domain may abuse this feature to escalate their privileges or establish a backdoor account
- in a stealthy way and without noisy group memberhip changes.
+description: The following analytic looks for changes to the sIDHistory AD attribute of user or computer objects which exist within the same domain. 
+ The SID history AD attribute allows users to inherit permissions from a separate AD account without group changes. Initially developed for access
+ continuity when migrating user accounts to different domains, this attribute can also be abused to stealthily grant access to a backdoor account within the same domain. 
+ This analytic was written to pick up on activity via Mimikatz sid::patch. Please note there are additional avenues to abuse SID history such as DCShadow & Golden / Diamond tickets which won't be detected using these event codes.
 search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistory
   IN ("%%1793", -)
   | rex field=SidHistory "(^%{|^)(?P<SidHistoryMatch>.*)(\-|\\\)"
@@ -17,11 +16,11 @@ search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistor
   | where SidHistoryMatch=TargetSidmatch OR SidHistoryMatch=TargetDomainName
   | rename TargetSid as userSid, TargetDomainName as userDomainName
   | table _time action status host user userSid userDomainName SidHistory Logon_ID src_user 
-  | `windows_active_directory_sid_history_abuse_filter`'
+  | `windows_active_directory_same_domain_sid_history_addition_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting eventcodes
  `4738` and `4742`. The Advanced Security Audit policy settings 
  `Audit User Account Management` and  `Audit Computer Account Management`
- within `Account Management` need to be enabled. SID resolution is not required.
+ within `Account Management` all need to be enabled. SID resolution is not required.
 known_false_positives: Unknown
 references:
 - https://adsecurity.org/?p=1772
@@ -36,7 +35,7 @@ tags:
   - CIS 4
   - CIS 6
   - CIS 16
-  confidence: 90
+  confidence: 100
   context:
   - Source:AD
   - Stage:Persistence
@@ -74,5 +73,5 @@ tags:
   - user
   - src_user
   - Logon_ID
-  risk_score: 90
+  risk_score: 100
   security_domain: endpoint

detections/endpoint/windows_active_directory_sid_history_addition.yml

@@ -0,0 +1,75 @@
+name: Windows Active Directory SID History Addition
+id: 41bbb371-28ba-439c-bb5c-d9930c28365d
+version: 1
+date: '2022-11-17'
+author: Dean Luxton
+type: TTP
+datamodel: []
+description: The following analytic looks for changes to the sIDHistory AD attribute of user or computer objects. 
+ The SID history AD attribute allows users to inherit permissions from a separate AD account without group changes. Initially developed for access
+ continuity when migrating user accounts to different domains, this attribute can be abused for inter-domain privilege escalation and persistence. 
+search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) (SidHistory!="%%1793"
+  AND SidHistory!="-")
+
+  | rename TargetSid as userSid
+
+  | table _time action status host user userSid SidHistory Logon_ID src_user | `windows_active_directory_sid_history_addition_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting eventcodes
+ `4738` and `4742`. The Advanced Security Audit policy settings
+ `Audit User Account Management` and  `Audit Computer Account Management`
+ within `Account Management` all need to be enabled.
+known_false_positives: Domain mergers and migrations may generate large volumes of false positives for this analytic. 
+  Where this use case is not viable, please see the two auxillery use cases for same domain and privileged SID history additions. 
+references:
+- https://adsecurity.org/?p=1772
+- https://learn.microsoft.com/en-us/windows/win32/adschema/a-sidhistory?redirectedfrom=MSDN
+- https://learn.microsoft.com/en-us/defender-for-identity/security-assessment-unsecure-sid-history-attribute
+tags:
+  analytic_story:
+  - Windows Domain Controller Attacks
+ asset_type: Endpoint
+  cis20:
+  - CIS 4
+  - CIS 6
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:AD
+  - Stage:Persistence
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134.005/mimikatz/windows-security-xml.log
+  impact: 100
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Active Directory SID History Attribute was added to $user$ by $src_user$
+  mitre_attack_id:
+  - T1134.005
+  - T1134
+  nist:
+  - DE.CM
+  observable:
+  - name: src_user
+    type: User
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - SidHistory
+  - TargetSid
+  - TargetDomainName
+  - user
+  - src_user
+  - Logon_ID
+  risk_score: 80
+  security_domain: endpoint
+

detections/endpoint/windows_dsrm_account_changes.yml

@@ -1,4 +1,4 @@
-name: DSRM Account Changes
+name: Windows DSRM Account Changes
 id: 08cb291e-ea77-48e8-a95a-0799319bf056
 version: 1
 date: '2022-09-08'
@@ -20,7 +20,7 @@ search: '| tstats `security_content_summariesonly` min(_time) as _time from data
   Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
   | `drop_dm_object_name(Processes)`]
   | table _time action dest user parent_process_name parent_process process_name process
-  process_guid registry_path registry_value_data registry_value_type | `dsrm_account_changes_filter`'
+  process_guid registry_path registry_value_data registry_value_type | `windows_dsrm_account_changes_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records registry activity from your hosts to populate the endpoint data model
   in the registry node. This is typically populated via endpoint detection-and-response

detections/endpoint/windows_dsrm_password_reset.yml

@@ -1,4 +1,4 @@
-name: DSRM Password Reset
+name: Windows DSRM Password Reset
 id: d1ab841c-36a6-46cf-b50f-b2b04b31182a
 version: 1
 date: '2022-09-08'
@@ -13,7 +13,7 @@ search: '| tstats `security_content_summariesonly` min(_time) as _time from data
   where All_Changes.result_id="4794" AND All_Changes.result="An attempt was made to
   set the Directory Services Restore Mode administrator password" by All_Changes.action, 
   All_Changes.dest, All_Changes.src, All_Changes.user
-  | `drop_dm_object_name(All_Changes)` | `dsrm_password_reset_filter`'
+  | `drop_dm_object_name(All_Changes)` | `windows_dsrm_password_reset_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting eventcode
  `4794` and  have the Advanced Security Audit policy
  `Audit User Account Management` within `Account Management` enabled. 

detections/endpoint/windows_short_lived_domain_controller_spn_ad_attribute.yml

@@ -1,23 +1,24 @@
-name: Windows DCShadow Attack
+name: Windows Short Lived Domain Controller SPN AD Attribute
 id: 57e27f27-369c-4df8-af08-e8c7ee8373d4 
 version: 2
 date: '2022-09-02'
 author: Dean Luxton
 type: TTP
 datamodel: []
-description: The following analytic identifies a change in an Active Directory environment that could represent evidence of the DCShadow attack.  
+description: The following analytic identifies when either a global catalog SPN or a DRS RPC SPN are temporarily added to an Active Directory computer object, both of which can be evidence of a DCShadow attack.  
   DCShadow allows an attacker who has obtained privileged access to register a rogue Domain Controller (DC). Once registered, the rogue DC may be able to inject
-  and replicate changes int the AD infrastructure for any domain object, including credentials and keys. This technique was initially released in 2018 by security researchers Benjamin Delpy and Vincent Le Toux.
+  and replicate changes into the AD infrastructure for any domain object, including credentials and keys. This technique was initially released in 2018 by security researchers Benjamin Delpy and Vincent Le Toux.
   No event logs are written for changes to AD attributes, allowing for stealthy backdoors to be implanted in the domain, or metadata such as timestamps overwritten to cover tracks. 
 search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName (AttributeValue="GC/*" OR AttributeValue="E3514235-4B06-11D1-AB04-00C04FC2DCD2/*")
-| replace "%%14674" with "Value Added", "%%14675" with "Value Deleted" in OperationType
-| stats min(_time) as firstEvent max(_time) as latestEvent values(OperationType) as Action range(_time) as duration by src_nt_domain, src_user, Computer, ObjectDN, Logon_ID, signature
-| where mvcount(Action) >1
-| join type=outer Logon_ID [| search `wineventlog_security` EventCode=4624  | rename TargetLogonId as Logon_ID src_ip as src]
-| table firstEvent, latestEvent, duration, src_nt_domain, src_user, Computer, ObjectDN, Action, signature, src, Logon_ID
-| eval firstEvent=strftime(firstEvent, "%Y-%m-%d %H:%M:%S"), latestEvent=strftime(latestEvent, "%Y-%m-%d %H:%M:%S")
-| `windows_dcshadow_attack_filter`' 
-how_to_implement: To successfully implement this search, you ned to be ingesting eventcode 
+ | stats min(_time) as _time range(_time) as duration values(OperationType) as OperationType values(src_nt_domain) as src_nt_domain values(src_user) as src_user values(Computer) as Computer, values(ObjectDN) as ObjectDN by Logon_ID
+ | eval short_lived=case((duration<30),"TRUE")
+ | where short_lived="TRUE" AND mvcount(OperationType)>1
+ | replace "%%14674" with "Value Added", "%%14675" with "Value Deleted" in OperationType
+ | rename Logon_ID as TargetLogonId
+ | appendpipe [| map search="search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$"]
+ | stats min(_time) as _time, values(TargetUserSid) as TargetUserSid, values(Target_Domain) as Target_Domain, values(user) as user, values(Computer) as Computer, values(status) as status, values(src_category) as src_category, values(src_ip) as src_ip values(ObjectDN) as ObjectDN values(OperationType) as OperationType by TargetLogonId
+ | `windows_short_lived_domain_controller_spn_ad_attribute_filter`' 
+how_to_implement: To successfully implement this search, you need to be ingesting eventcode 
  `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` 
  within `DS Access` needs to be enabled, alongside a SACL for `everybody` to 
  `Write All Properties` applied to the domain root and all descendant objects. 
@@ -44,17 +45,17 @@ tags:
   impact: 100
   kill_chain_phases:
   - Actions on Objectives
-  message: Potential DCShadow Attack Detected from $src$
+  message: Short Lived Domain Controller SPN AD Attribute Triggered by $user$ from $src_ip$
   mitre_attack_id:
   - T1207
   nist:
   - DE.CM
   observable:
-  - name: src_user
+  - name: user
     type: User
     role:
     - Victim
-  - name: src
+  - name: src_ip
     type: IP Address
     role:
     - Attacker

detections/experimental/endpoint/windows_active_directory_privileged_account_sid_history_addition.yml

@@ -1,4 +1,4 @@
-name: Active Directory SID History Privileged Account Addition
+name: Windows Active Directory Privileged Account SID History Addition
 id: 6b521149-b91c-43aa-ba97-c2cac59ec830
 version: 1
 date: '2022-09-12'
@@ -7,8 +7,8 @@ type: TTP
 datamodel: []
 description: This detection identifies when the SID of a privileged user is added to
  the SID History attribute of another user. Useful for tracking SID history abuse 
- accross multiple domains. This detection leverages the Asset and Identities 
- framework. See the implemention section for further details on configuration.  
+ across multiple domains. This detection leverages the Asset and Identities 
+ framework. See the implementation section for further details on configuration.  
 search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistory IN ("%%1793", -) 
  | rex field=SidHistory "(^%{|^)(?P<SidHistory>.*?)(}$|$)" 
  | eval category="privileged" 
@@ -16,11 +16,10 @@ search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistor
  | where isnotnull(match)
  | rename TargetSid as userSid 
  | table _time action status host user userSid SidHistory Logon_ID src_user
-  | `active_directory_sid_history_privileged_account_addition_filter`'
+  | `windows_active_directory_privileged_account_sid_history_addition_filter`'
 how_to_implement: Ensure you have objectSid and the Down Level Logon Name `DOMAIN\sAMACountName`
  added to the identity field of your Asset and Identities lookup, along with the 
- category of privileged for the applicable users. If unsure, users with the AdminCount 
- attribute set with the value of 1 are great candidates. Also ensure you are 
+ category of privileged for the applicable users. Ensure you are 
  ingesting eventcodes 4742 and 4738. Two advanced audit policies 
  `Audit User Account Management` and `Audit Computer Account Management` under 
  `Account Management` are required to generate these event codes. 

tests/endpoint/windows_active_directory_replication_request_initiated_from_unsanctioned_location.test.yml

@@ -0,0 +1,13 @@
+name: Windows Replication Event from Non-DC Computer Account Unit Test
+tests:
+- name: Windows Replication Event from Non-DC Computer Account
+  file: endpoint/windows_replication_event_from_non_dc_computer_account.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: UPDATE
+    data: UPDATE
+    source: UPDATE
+    sourcetype: UPDATE
+    update_timestamp: true

tests/endpoint/windows_active_directory_sid_history_addition.test.yml

@@ -0,0 +1,13 @@
+name: Windows Active Directory SID History Addition Unit Test
+tests:
+- name: Windows Active Directory SID History Addition
+  file: endpoint/windows_active_directory_sid_history_addition.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: UPDATE
+    data: UPDATE
+    source: UPDATE
+    sourcetype: UPDATE
+    update_timestamp: true