Branch was auto-updated.

2026-06-08 17:32:49 +00:00 · 2024-08-21 14:58:13 +05:30
parent df2acf9822 b909d351bb
commit 29f7ea8bf8
36 changed files with 3049 additions and 93 deletions
@@ -188,6 +188,12 @@ apps:
  version: 1.9.2
  description: description of app
  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz
+- uid: 6853
+  title: Splunk Add-on for Admon Enrichment
+  appid: SA-admon
+  version: 1.1.0
+  description: description of app
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-admon-enrichment_112.tgz
 - uid: 5082
  title: CrowdStrike Falcon Event Streams Technical Add-On
  appid: TA-crowdstrike-falcon-event-streams
@@ -0,0 +1,84 @@
+name: Windows AD Dangerous Deny ACL Modification
+id: 8e897153-2ebd-4cb2-85d3-09ad57db2fb7
+version: 1
+date: '2023-11-21'
+author: Dean Luxton
+status: production
+type: TTP
+data_source:
+- Windows Security 5136
+description: This detection identifies an Active Directory access-control list (ACL) modification event, which applies permissions that deny the ability to enumerate permissions of the object.  
+search: >-
+  `wineventlog_security` EventCode=5136
+  | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId 
+  | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)" 
+  | rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)" 
+  | mvexpand new_ace 
+  | where NOT new_ace IN (old_values) 
+  | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$" 
+  | rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})" 
+  | rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})" 
+  | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights 
+  | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value 
+  | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType
+  | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value
+  ``` Optional SID resolution lookups
+  | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user 
+  | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ```
+  | lookup builtin_groups_lookup builtin_group_string  as aceSid OUTPUT builtin_group_name as builtin_group
+  | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid)
+  | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID
+  | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights')
+  | search aceType IN ("Access denied",D) AND aceAccessRights IN ("Full control","Read permissions",RC)
+  | `windows_ad_dangerous_deny_acl_modification_filter`
+how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. 
+  See lantern article in references for further on how to onboard AD audit data. Ensure the 
+  wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. 
+known_false_positives: None. 
+references:
+- https://happycamper84.medium.com/sneaky-persistence-via-hidden-objects-in-ad-1c91fc37bf54
+- https://www.youtube.com/watch?v=_nGpZ1ydzS8
+- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
+tags:
+  analytic_story:
+    - Sneaky Active Directory Persistence Tricks
+  asset_type: Endpoint
+  confidence: 100
+  impact: 100
+  message: $src_user$ has added ACL rights to deny $user$ $aceControlAccessRights$ $aceAccessRights$ to $ObjectDN$
+  mitre_attack_id:
+  - T1484
+  - T1222
+  - T1222.001
+  observable:
+    - name: user
+      type: User
+      role:
+        - Victim
+    - name: src_user
+      type: User
+      role:
+        - Victim
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  risk_score: 100
+  required_fields:
+    - _time
+    - OperationType
+    - ObjectDN
+    - OpCorrelationID
+    - src_user
+    - AttributeLDAPDisplayName
+    - AttributeValue
+    - ObjectClass
+    - SubjectLogonId
+    - DSName
+  security_domain: endpoint
+tests:
+  - name: True Positive Test
+    attack_data:
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/hidden_object_windows-security-xml.log
+        source: XmlWinEventLog:Security
+        sourcetype: xmlwineventlog
@@ -0,0 +1,88 @@
+name: Windows AD Dangerous Group ACL Modification
+id: 59b0fc85-7a0d-4585-97ec-06a382801990
+version: 1
+date: '2023-11-13'
+author: Dean Luxton
+status: production
+type: TTP
+data_source:
+- Windows Security 5136
+description: >-
+  This detection monitors the addition of the following ACLs to an Active Directory group object: "Full control", "All extended rights", "All validated writes", 
+  "Create all child objects", "Delete all child objects", "Delete subtree", "Delete", "Modify permissions", "Modify owner", and "Write all properties". 
+  Such modifications can indicate potential privilege escalation or malicious activity. Immediate investigation is recommended upon alert.
+search: >-
+  `wineventlog_security` EventCode=5136 ObjectClass=group
+  | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId 
+  | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)" 
+  | rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)" 
+  | mvexpand new_ace 
+  | where NOT new_ace IN (old_values) 
+  | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$" 
+  | rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})" 
+  | rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})" 
+  | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType
+  | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value
+  | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value 
+  | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights
+  ``` Optional SID resolution lookups
+  | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user 
+  | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ```
+  | lookup builtin_groups_lookup builtin_group_string  as aceSid OUTPUT builtin_group_name as builtin_group
+  | eval aceType=coalesce(ace_type_value,aceType), aceInheritance=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)), user=coalesce(user, group, builtin_group, aceSid)
+  | stats values(aceType) as aceType values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID
+  | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights')
+  | search NOT aceType IN ("*denied*","D","OD","XD") AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP)
+  | `windows_ad_dangerous_group_acl_modification_filter`
+how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. 
+  See lantern article in references for further on how to onboard AD audit data. Ensure the 
+  wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. 
+known_false_positives: Unknown
+references:
+- https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings
+- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb
+- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a
+- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
+tags:
+  analytic_story:
+    - Sneaky Active Directory Persistence Tricks
+  asset_type: Endpoint
+  confidence: 100
+  impact: 100
+  message: $src_user$ has added ACL rights to grant $user$ $aceControlAccessRights$ $aceAccessRights$ to group $ObjectDN$
+  mitre_attack_id:
+  - T1484
+  - T1222
+  - T1222.001
+  observable:
+    - name: user
+      type: User
+      role:
+        - Victim
+    - name: src_user
+      type: User
+      role:
+        - Victim
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  risk_score: 100
+  required_fields:
+    - _time
+    - OperationType
+    - ObjectDN
+    - OpCorrelationID
+    - src_user
+    - AttributeLDAPDisplayName
+    - AttributeValue
+    - ObjectClass
+    - SubjectLogonId
+    - DSName
+  security_domain: endpoint
+tests:
+  - name: True Positive Test
+    attack_data:
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/group_dacl_mod_windows-security-xml.log
+        source: XmlWinEventLog:Security
+        sourcetype: xmlwineventlog
@@ -0,0 +1,88 @@
+name: Windows AD Dangerous User ACL Modification
+id: ec5b6790-595a-4fb8-ad43-56e5b55a9617
+version: 1
+date: '2023-11-15'
+author: Dean Luxton
+status: production
+type: TTP
+data_source:
+- Windows Security 5136
+description: >-
+  This detection monitors the addition of the following ACLs to an Active Directory user object: "Full control","All extended rights","All validated writes",
+  "Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties". 
+  Such modifications can indicate potential privilege escalation or malicious activity. Immediate investigation is recommended upon alert.
+search: >-
+  `wineventlog_security` EventCode=5136 ObjectClass=user 
+  | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId 
+  | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)" 
+  | rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)" 
+  | mvexpand new_ace 
+  | where NOT new_ace IN (old_values) 
+  | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$" 
+  | rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})" 
+  | rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})" 
+  | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights 
+  | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value 
+  | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType
+  | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value
+  ``` Optional SID resolution lookups
+  | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user 
+  | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ```
+  | lookup builtin_groups_lookup builtin_group_string  as aceSid OUTPUT builtin_group_name as builtin_group
+  | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid)
+  | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID
+  | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights')
+  | search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP)
+  | `windows_ad_dangerous_user_acl_modification_filter`
+how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. 
+  See lantern article in references for further on how to onboard AD audit data. Ensure the 
+  wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. 
+known_false_positives: Unknown
+references:
+- https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings
+- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb
+- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a
+- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
+tags:
+  analytic_story:
+    - Sneaky Active Directory Persistence Tricks
+  asset_type: Endpoint
+  confidence: 100
+  impact: 100
+  message: $src_user$ has added ACL rights to grant $user$ $aceControlAccessRights$ $aceAccessRights$ to user $ObjectDN$
+  mitre_attack_id:
+  - T1484
+  - T1222
+  - T1222.001
+  observable:
+    - name: user
+      type: User
+      role:
+        - Victim
+    - name: src_user
+      type: User
+      role:
+        - Victim
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  risk_score: 100
+  required_fields:
+    - _time
+    - OperationType
+    - ObjectDN
+    - OpCorrelationID
+    - src_user
+    - AttributeLDAPDisplayName
+    - AttributeValue
+    - ObjectClass
+    - SubjectLogonId
+    - DSName
+  security_domain: endpoint
+tests:
+  - name: True Positive Test
+    attack_data:
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/user_dacl_mod_windows-security-xml.log
+        source: XmlWinEventLog:Security
+        sourcetype: xmlwineventlog
@@ -0,0 +1,83 @@
+name: Windows AD DCShadow Privileges ACL Addition
+id: ae915743-1aa8-4a94-975c-8062ebc8b723
+version: 1
+date: '2023-11-10'
+author: Dean Luxton
+status: production
+type: TTP
+data_source:
+- Windows Security 5136
+description: This detection identifies an Active Directory access-control list (ACL) modification event, which applies the minimum required extended rights to perform the DCShadow attack. 
+search: >-
+  `wineventlog_security` EventCode=5136 ObjectClass=domainDNS 
+  | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId 
+  | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)" 
+  | rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)" 
+  | mvexpand new_ace
+  | where NOT new_ace IN (old_values) 
+  | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);;(?P<aceSid>.*?)$"
+  | search aceObjectGuid IN ("9923a32a-3607-11d2-b9be-0000f87a36b2","1131f6ab-9c07-11d1-f79f-00c04fc2dcd2","1131f6ac-9c07-11d1-f79f-00c04fc2dcd2")
+  | rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})" 
+  | rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})" 
+  | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights
+  | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value 
+  | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value 
+  | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value
+  ``` Optional SID resolution lookups
+  | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user 
+  | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ```
+  | lookup builtin_groups_lookup builtin_group_string  as aceSid OUTPUT builtin_group_name as builtin_group
+  | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid)
+  | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user user
+  | search (aceControlAccessRights="Add/Remove Replica In Domain" AND aceControlAccessRights="Manage Replication Topology" AND aceControlAccessRights="Replication Synchronization") OR (aceControlAccessRights="9923a32a-3607-11d2-b9be-0000f87a36b2" AND aceControlAccessRights="1131f6ab-9c07-11d1-f79f-00c04fc2dcd2" AND aceControlAccessRights="1131f6ac-9c07-11d1-f79f-00c04fc2dcd2")
+  | `windows_ad_dcshadow_privileges_acl_addition_filter`
+how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. 
+  See lantern article in references for further on how to onboard AD audit data. Ensure the 
+  wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. 
+known_false_positives: Unknown
+references:
+- https://www.labofapenetrationtester.com/2018/04/dcshadow.html
+- https://github.com/samratashok/nishang/blob/master/ActiveDirectory/Set-DCShadowPermissions.ps1
+- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a
+- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
+tags:
+  analytic_story:
+    - Sneaky Active Directory Persistence Tricks
+  asset_type: Endpoint
+  confidence: 100
+  impact: 100
+  message: ACL modification Event Initiated by $src_user$ applying $user$ the minimum required extended rights to perform a DCShadow attack. 
+  mitre_attack_id:
+  - T1484
+  - T1207
+  - T1222.001
+  observable:
+    - name: user
+      type: User
+      role:
+        - Victim
+    - name: src_user
+      type: User
+      role:
+        - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 100
+  required_fields:
+    - _time
+    - OperationType
+    - src_user
+    - AttributeLDAPDisplayName
+    - AttributeValue
+    - ObjectClass
+    - SubjectLogonId
+    - DSName
+  security_domain: endpoint
+tests:
+  - name: True Positive Test
+    attack_data:
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/DCShadowPermissions/windows-security-xml.log
+        source: XmlWinEventLog:Security
+        sourcetype: xmlwineventlog
@@ -0,0 +1,84 @@
+name: Windows AD Domain Root ACL Deletion
+id: 3cb56e57-5642-4638-907f-8dfde9afb889
+version: 1
+date: '2023-11-13'
+author: Dean Luxton
+status: production
+type: TTP
+data_source:
+- Windows Security 5136
+description: ACL deletion performed on the domain root object, significant AD change with high impact. Following MS guidance all changes at this level should be reviewed. Drill into the logonID within EventCode 4624 for information on the source device during triage. 
+search: >-
+  `wineventlog_security` EventCode=5136 ObjectClass=domainDNS 
+  | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId 
+  | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)" 
+  | rex field=new_value max_match=10000 "\((?P<new_values>.*?)\)" 
+  | mvexpand old_values 
+  | where NOT old_values IN (new_values) 
+  | rex field=old_values "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);;(?P<aceSid>.*?)$" 
+  | rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})" 
+  | rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})" 
+  | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights 
+  | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value 
+  | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value 
+  | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value
+  ``` Optional SID resolution lookups
+  | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user 
+  | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ```
+  | lookup builtin_groups_lookup builtin_group_string  as aceSid OUTPUT builtin_group_name as builtin_group
+  | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid)
+  | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(old_values) as old_values by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID
+  | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights')
+  | `windows_ad_domain_root_acl_deletion_filter`
+how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. 
+  See lantern article in references for further on how to onboard AD audit data. Ensure the 
+  wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. 
+known_false_positives: Unknown
+references:
+- https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings
+- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb
+- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a
+- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
+tags:
+  analytic_story:
+    - Sneaky Active Directory Persistence Tricks
+  asset_type: Endpoint
+  confidence: 100
+  impact: 100
+  message: $src_user$ has removed $user$ $aceAccessRights$ ACL rights to domain root $ObjectDN$
+  mitre_attack_id:
+  - T1484
+  - T1222
+  - T1222.001
+  observable:
+    - name: user
+      type: User
+      role:
+        - Victim
+    - name: src_user
+      type: User
+      role:
+        - Victim
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  risk_score: 100
+  required_fields:
+    - _time
+    - OperationType
+    - ObjectDN
+    - OpCorrelationID
+    - src_user
+    - AttributeLDAPDisplayName
+    - AttributeValue
+    - ObjectClass
+    - SubjectLogonId
+    - DSName
+  security_domain: endpoint
+tests:
+  - name: True Positive Test
+    attack_data:
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/domain_root_acl_deletion_windows-security-xml.log
+        source: XmlWinEventLog:Security
+        sourcetype: xmlwineventlog
@@ -0,0 +1,84 @@
+name: Windows AD Domain Root ACL Modification
+id: 4981e2db-1372-440d-816e-3e7e2ed74433
+version: 1
+date: '2023-11-11'
+author: Dean Luxton
+status: production
+type: TTP
+data_source:
+- Windows Security 5136
+description: ACL modification performed on the domain root object, significant AD change with high impact. Following MS guidance all changes at this level should be reviewed. Drill into the logonID within EventCode 4624 for information on the source device during triage. 
+search: >-
+  `wineventlog_security` EventCode=5136 ObjectClass=domainDNS 
+  | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId 
+  | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)" 
+  | rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)" 
+  | mvexpand new_ace
+  | where NOT new_ace IN (old_values) 
+  | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);;(?P<aceSid>.*?)$"
+  | rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})" 
+  | rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})" 
+  | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights
+  | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value 
+  | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value 
+  | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value
+  ``` Optional SID resolution lookups
+  | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user 
+  | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ```
+  | lookup builtin_groups_lookup builtin_group_string  as aceSid OUTPUT builtin_group_name as builtin_group
+  | eval aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",'access_rights_value'), aceType=ace_type_value, aceFlags=coalesce(ace_flag_value,"This object only"), aceControlAccessRights=ControlAccessRights, user=coalesce(user, group, builtin_group, aceSid) 
+  | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID
+  | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights')
+  | `windows_ad_domain_root_acl_modification_filter`
+how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. 
+  See lantern article in references for further on how to onboard AD audit data. Ensure the 
+  wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. 
+known_false_positives: Unknown
+references:
+- https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings
+- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb
+- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a
+- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
+tags:
+  analytic_story:
+    - Sneaky Active Directory Persistence Tricks
+  asset_type: Endpoint
+  confidence: 100
+  impact: 100
+  message: $src_user$ has granted $user$ $aceAccessRights$ ACL rights to domain root $ObjectDN$
+  mitre_attack_id:
+  - T1484
+  - T1222
+  - T1222.001
+  observable:
+    - name: user
+      type: User
+      role:
+        - Victim
+    - name: src_user
+      type: User
+      role:
+        - Victim
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  risk_score: 100
+  required_fields:
+    - _time
+    - OperationType
+    - ObjectDN
+    - OpCorrelationID
+    - src_user
+    - AttributeLDAPDisplayName
+    - AttributeValue
+    - ObjectClass
+    - SubjectLogonId
+    - DSName
+  security_domain: endpoint
+tests:
+  - name: True Positive Test
+    attack_data:
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/domain_root_acl_mod_windows-security-xml.log
+        source: XmlWinEventLog:Security
+        sourcetype: xmlwineventlog
@@ -0,0 +1,67 @@
+name: Windows AD GPO Deleted
+id: 0d41772b-35ab-4e1c-a2ba-d0b455481aee
+version: 1
+date: '2023-11-24'
+author: Dean Luxton
+status: production
+type: TTP
+data_source:
+- Windows Security 5136
+description: This detection identifies when an Active Directory Group Policy is deleted using the Group Policy Management Console. 
+search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=gpLink | eval  ObjectDN=upper(ObjectDN)
+  | stats min(_time) as eventTime values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(src_user) as src_user by OpCorrelationID ObjectDN SubjectLogonId
+  | rex field=old_value max_match=10000 "(?i)LDAP://(?P<old_dn>cn.*?);(?P<old_flag>\d)\]" 
+  | rex field=new_value max_match=10000 "(?i)LDAP://(?P<new_dn>cn.*?);(?P<new_flag>\d)\]"
+  | mvexpand old_dn 
+  | where NOT old_dn IN (new_dn)
+  | eval ObjectDN=upper(old_dn)
+  | join ObjectDN type=outer [| search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update | eval ObjectDN=upper(distinguishedName) | stats latest(displayName) as displayName by ObjectDN ]
+  | stats min(eventTime) as _time values(OpCorrelationID) as OpCorrelationID values(displayName) as policyName values(src_user) as src_user by ObjectDN SubjectLogonId
+  | `windows_ad_gpo_deleted_filter`'
+how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136, admon data is also used to display 
+  the display name of the GPO. See lantern article in references for further on how to onboard AD audit data. Ensure the 
+  wineventlog_security and admon macros are configured with the correct indexes. 
+known_false_positives: Unknown
+references:
+- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
+tags:
+  analytic_story:
+    - Sneaky Active Directory Persistence Tricks
+  asset_type: Endpoint
+  confidence: 80
+  impact: 80
+  message: GPO $policyName$ was deleted by $src_user$
+  mitre_attack_id:
+  - T1562.001
+  - T1484.001
+  observable:
+    - name: src_user
+      type: User
+      role:
+        - Victim
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  risk_score: 64
+  required_fields:
+    - _time
+    - OperationType
+    - ObjectDN
+    - OpCorrelationID
+    - src_user
+    - AttributeLDAPDisplayName
+    - AttributeValue
+    - ObjectClass
+    - SubjectLogonId
+    - DSName
+  security_domain: endpoint
+tests:
+  - name: True Positive Test
+    attack_data:
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_deleted/windows-security.log
+        source: XmlWinEventLog:Security
+        sourcetype: xmlwineventlog
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_deleted/windows-admon.log
+        source: ActiveDirectory
+        sourcetype: ActiveDirectory
@@ -0,0 +1,62 @@
+name: Windows AD GPO Disabled
+id: 72793bc0-c0cd-400e-9e60-fdf36f278917
+version: 1
+date: '2023-11-24'
+author: Dean Luxton
+status: production
+type: TTP
+data_source:
+- Windows Security 5136
+description: This detection identifies when an Active Directory Group Policy is disabled using the Group Policy Management Console. 
+search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=flags OperationType="%%14674" AttributeValue!=0
+  | eval AttributeValueExp=case(AttributeValue==0,"Enabled",AttributeValue==1,"User configuration settings disabled",AttributeValue==2,"Computer configuration settings disabled",AttributeValue==3,"Disabled"), ObjectDN=upper(ObjectDN)
+  | join ObjectDN type=outer [| search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update | eval ObjectDN=upper(distinguishedName) | stats latest(displayName) as displayName by ObjectDN ]
+  | stats min(_time) as _time values(AttributeValue) as AttributeValue values(AttributeValueExp) as AttributeValueExp values(OpCorrelationID) as OpCorrelationID values(displayName) as policyName values(src_user) as src_user by ObjectDN SubjectLogonId
+  | `windows_ad_gpo_disabled_filter`'
+how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136, admon data is also used to display 
+  the display name of the GPO. See lantern article in references for further on how to onboard AD audit data. Ensure the 
+  wineventlog_security and admon macros are configured with the correct indexes. 
+known_false_positives: Unknown
+references:
+- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
+tags:
+  analytic_story:
+    - Sneaky Active Directory Persistence Tricks
+  asset_type: Endpoint
+  confidence: 80
+  impact: 80
+  message: $src_user$ has disabled GPO $policyName$
+  mitre_attack_id:
+  - T1562.001
+  - T1484.001
+  observable:
+    - name: src_user
+      type: User
+      role:
+        - Victim
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  risk_score: 64
+  required_fields:
+    - _time
+    - OperationType
+    - ObjectDN
+    - OpCorrelationID
+    - src_user
+    - AttributeLDAPDisplayName
+    - AttributeValue
+    - ObjectClass
+    - SubjectLogonId
+    - DSName
+  security_domain: endpoint
+tests:
+  - name: True Positive Test
+    attack_data:
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_disabled/windows-security.log
+        source: XmlWinEventLog:Security
+        sourcetype: xmlwineventlog
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_disabled/windows-admon.log
+        source: ActiveDirectory
+        sourcetype: ActiveDirectory
@@ -0,0 +1,74 @@
+name: Windows AD GPO New CSE Addition
+id: 700c11d1-da09-47b2-81aa-358c143c7986
+version: 1
+date: '2023-11-22'
+author: Dean Luxton
+status: production
+type: TTP
+data_source:
+- Windows Security 5136
+description: This detection identifies when a a new client side extension is added to an Active Directory Group Policy using the Group Policy Management Console. 
+search: '`wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=gPCMachineExtensionNames
+  | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId 
+  | rex field=old_value max_match=10000 "(?P<old_values>\{.*?\})" 
+  | rex field=new_value max_match=10000 "(?P<new_values>\{.*?\})" 
+  | rex field=ObjectDN max_match=10000 "CN=(?P<policy_guid>\{.*?\})" 
+  | mvexpand new_values 
+  | where NOT new_values IN (old_values,"{00000000-0000-0000-0000-000000000000}",policy_guid) AND match(new_values, "^\{[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\}") 
+  | lookup msad_guid_lookup guid as new_values OUTPUTNEW displayName as policyType 
+  | eval newPolicy=if(policyType like "%",policyType,new_values)
+  | join ObjectDN  [| search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update | stats latest(displayName) as displayName by distinguishedName | eval ObjectDN=upper(distinguishedName)] 
+  | stats values(OpCorrelationID) as OpCorrelationID values(src_user) as src_user values(SubjectLogonId) as SubjectLogonId values(newPolicy) as newPolicy values(displayName) as policyName by ObjectDN
+  | `windows_ad_gpo_new_cse_addition_filter`'
+how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136, admon data is also used to display 
+  the display name of the GPO. See lantern article in references for further on how to onboard AD audit data. Ensure the 
+  wineventlog_security and admon macros are configured with the correct indexes. 
+known_false_positives: General usage of group policy will trigger this detection, also please not GPOs modified using tools such as SharpGPOAbuse will not generate the AD audit events which enable this detection. 
+references:
+- https://wald0.com/?p=179
+- https://learn.microsoft.com/en-gb/archive/blogs/mempson/group-policy-client-side-extension-list
+- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
+- https://github.com/FSecureLABS/SharpGPOAbuse
+tags:
+  analytic_story:
+    - Sneaky Active Directory Persistence Tricks
+  asset_type: Endpoint
+  confidence: 100
+  impact: 100
+  message: $src_user$ has added new GPO Client Side Extensions $newPolicy$ to the policy $policyName$
+  mitre_attack_id:
+  - T1484
+  - T1484.001
+  - T1222
+  - T1222.001
+  observable:
+    - name: src_user
+      type: User
+      role:
+        - Victim
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  risk_score: 100
+  required_fields:
+    - _time
+    - OperationType
+    - ObjectDN
+    - OpCorrelationID
+    - src_user
+    - AttributeLDAPDisplayName
+    - AttributeValue
+    - ObjectClass
+    - SubjectLogonId
+    - DSName
+  security_domain: endpoint
+tests:
+  - name: True Positive Test
+    attack_data:
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_new_cse/windows-security.log
+        source: XmlWinEventLog:Security
+        sourcetype: xmlwineventlog
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_new_cse/windows-admon.log
+        source: ActiveDirectory
+        sourcetype: ActiveDirectory
@@ -0,0 +1,83 @@
+name: Windows AD Hidden OU Creation
+id: 66b6ad5e-339a-40af-b721-dacefc7bdb75
+version: 1
+date: '2023-11-16'
+author: Dean Luxton
+status: production
+type: TTP
+data_source:
+- Windows Security 5136
+description: This analytic is looking for when an ACL is applied to an OU which denies listing the objects residing in the OU. This activity combined with modifying the owner of the OU will hide AD objects even from domain administrators. 
+search: >-
+  `wineventlog_security` EventCode=5136 ObjectClass=organizationalUnit
+  | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId 
+  | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)" 
+  | rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)" 
+  | mvexpand new_ace 
+  | where NOT new_ace IN (old_values) 
+  | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$" 
+  | rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})" 
+  | rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})" 
+  | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights 
+  | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value 
+  | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType
+  | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value
+  ``` Optional SID resolution lookups
+  | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user 
+  | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ```
+  | lookup builtin_groups_lookup builtin_group_string  as aceSid OUTPUT builtin_group_name as builtin_group
+  | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid)
+  | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID
+  | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights')
+  | search aceType IN ("Access denied",D) AND aceAccessRights IN ("List contents","List objects",LC,LO)
+  | `windows_ad_hidden_ou_creation_filter`
+how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. 
+  See lantern article in references for further on how to onboard AD audit data. Ensure the 
+  wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. 
+known_false_positives: None. 
+references:
+- https://happycamper84.medium.com/sneaky-persistence-via-hidden-objects-in-ad-1c91fc37bf54
+- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
+tags:
+  analytic_story:
+    - Sneaky Active Directory Persistence Tricks
+  asset_type: Endpoint
+  confidence: 100
+  impact: 100
+  message: $src_user$ has hidden the contents of OU $ObjectDN$ from $user$
+  mitre_attack_id:
+  - T1484
+  - T1222
+  - T1222.001
+  observable:
+    - name: user
+      type: User
+      role:
+        - Victim
+    - name: src_user
+      type: User
+      role:
+        - Victim
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  risk_score: 100
+  required_fields:
+    - _time
+    - OperationType
+    - ObjectDN
+    - OpCorrelationID
+    - src_user
+    - AttributeLDAPDisplayName
+    - AttributeValue
+    - ObjectClass
+    - SubjectLogonId
+    - DSName
+  security_domain: endpoint
+tests:
+  - name: True Positive Test
+    attack_data:
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/hidden_ou_windows-security-xml.log
+        source: XmlWinEventLog:Security
+        sourcetype: xmlwineventlog
@@ -0,0 +1,78 @@
+name: Windows AD Object Owner Updated
+id: 4af01f6b-d8d4-4f96-8635-758a01557130
+version: 1
+date: '2023-11-13'
+author: Dean Luxton
+status: production
+type: TTP
+data_source:
+- Windows Security 5136
+description: AD Object Owner Updated. The owner provides Full control level privileges over the target AD Object. This event has significant impact alone and is also a precursor activity for hiding an AD object. 
+search: ' `wineventlog_security` EventCode=5136 
+  | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId DSName
+  | rex field=old_value "O:(?P<old_owner>.*?)G:"
+  | rex field=new_value "O:(?P<new_owner>.*?)G:"
+  | where old_owner!=new_owner
+  ``` optional SID resolution lookups
+  | lookup identity_lookup_expanded objectSid as new_owner OUTPUT downLevelDomainName as new_owner_user 
+  | lookup admon_groups_def objectSid as new_owner OUTPUT cn as new_owner_group
+  | lookup identity_lookup_expanded objectSid as old_owner OUTPUT downLevelDomainName as old_owner_user 
+  | lookup admon_groups_def objectSid as old_owner OUTPUT cn as old_owner_group
+  ```
+  | lookup builtin_groups_lookup builtin_group_string  as new_owner_group OUTPUT builtin_group_name as new_owner_group_builtin_group
+  | lookup builtin_groups_lookup builtin_group_string  as old_owner OUTPUT builtin_group_name as old_owner_group_builtin_group
+  | eval user=coalesce(new_owner_user, new_owner_group, new_owner_group_builtin_group, new_owner), previousOwner=coalesce(old_owner_user, old_owner_group, old_owner_group_builtin_group, old_owner)
+  | stats values(previousOwner) as previousOwner values(user) as user values(SubjectLogonId) as SubjectLogonId by _time ObjectClass ObjectDN src_user OpCorrelationID DSName
+  | `windows_ad_object_owner_updated_filter`'
+how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. 
+  See lantern article in references for further on how to onboard AD audit data. Ensure the 
+  wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. 
+known_false_positives: Unknown
+references:
+- https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings
+- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb
+- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a
+- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
+tags:
+  analytic_story:
+    - Sneaky Active Directory Persistence Tricks
+  asset_type: Endpoint
+  confidence: 100
+  impact: 100
+  message: $src_user$ has made $user$ the owner of AD object $ObjectDN$
+  mitre_attack_id:
+  - T1484
+  - T1222
+  - T1222.001
+  observable:
+    - name: user
+      type: User
+      role:
+        - Victim
+    - name: src_user
+      type: User
+      role:
+        - Victim
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  risk_score: 100
+  required_fields:
+    - _time
+    - OperationType
+    - ObjectDN
+    - OpCorrelationID
+    - src_user
+    - AttributeLDAPDisplayName
+    - AttributeValue
+    - ObjectClass
+    - SubjectLogonId
+    - DSName
+  security_domain: endpoint
+tests:
+  - name: True Positive Test
+    attack_data:
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/owner_updated_windows-security-xml.log
+        source: XmlWinEventLog:Security
+        sourcetype: xmlwineventlog
@@ -0,0 +1,54 @@
+name: Windows AD Privileged Group Modification
+id: 187bf937-c436-4c65-bbcb-7539ffe02da1
+version: 1
+date: '2023-09-27'
+author: Dean Luxton
+status: experimental
+type: TTP
+data_source:
+- XmlWinEventLog:Security
+description: Detect users added to privileged AD Groups. 
+search: '`wineventlog_security` EventCode IN (4728)
+  | stats min(_time) as _time dc(user) as usercount, values(user) as user values(user_category) as user_category values(src_user_category) as src_user_category values(dvc) as dvc by signature, Group_Name,src_user
+  | lookup admon_groups_def  cn as Group_Name OUTPUT category
+  | where category="privileged" | `windows_ad_privileged_group_modification_filter`'
+how_to_implement: This analytic requires eventCode 4728 to be ingested along with the admon_groups_def lookup being configured to include a list of AD groups along with a category to identify privileged groups. 
+  See splunkbase app listed in the references for further details.
+known_false_positives: None
+references:
+- https://splunkbase.splunk.com/app/6853
+tags:
+  analytic_story:
+  - Active Directory Privilege Escalation
+  - Sneaky Active Directory Persistence Tricks
+  asset_type: Endpoint
+  confidence: 100
+  impact: 50
+  message: $user$ was added to privileged AD Group $Group_Name$ by $src_user$
+  mitre_attack_id:
+  - T1098
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 50
+  required_fields:
+  - EventCode
+  - user
+  - src_user
+  - signature
+  - Group_Name
+  - dest
+  security_domain: identity
+  manual_test: This search uses a lookup provided by Enterprise Security and needs to be manually tested.
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog
@@ -0,0 +1,79 @@
+name: Windows AD Self DACL Assignment
+id: 16132445-da9f-4d03-ad44-56d717dcd67d
+version: 1
+date: '2023-12-18'
+author: Dean Luxton
+status: production
+type: TTP
+data_source:
+- Windows Security 5136
+description: Detect when a user creates a new DACL in AD for their own AD object. 
+search: >-
+  `wineventlog_security` EventCode=5136 
+  | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId 
+  | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)" 
+  | rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)" 
+  | mvexpand new_ace 
+  | where NOT new_ace IN (old_values) 
+  | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$" 
+  | rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})" 
+  | rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})" 
+  | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType 
+  | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value 
+  | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value 
+  | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights
+  ``` Optional SID resolution lookups 
+  | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user 
+  | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group 
+  ```
+  | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group 
+  | eval aceType=coalesce(ace_type_value,aceType), aceInheritance=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)), user=coalesce(user, group, builtin_group, aceSid) 
+  | stats values(aceType) as aceType values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID 
+  | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights')
+  | rex field=user "\\\(?P<nt_user>.*?)$"
+  | where lower(src_user)=lower(nt_user)
+  | `windows_ad_self_dacl_assignment_filter`
+how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. 
+  See lantern article in references for further on how to onboard AD audit data. Ensure the 
+  wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. 
+known_false_positives: Unknown
+references:
+- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
+tags:
+  analytic_story:
+    - Sneaky Active Directory Persistence Tricks
+  asset_type: Endpoint
+  confidence: 100
+  impact: 80
+  message: $src_user$ has created a DACL on $ObjectDN$ to grant themselves $aceControlAccessRights$ across $aceAccessRights$
+  mitre_attack_id:
+  - T1484
+  - T1098
+  observable:
+    - name: src_user
+      type: User
+      role:
+        - Victim
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  risk_score: 80
+  required_fields:
+    - _time
+    - OperationType
+    - ObjectDN
+    - OpCorrelationID
+    - src_user
+    - AttributeLDAPDisplayName
+    - AttributeValue
+    - ObjectClass
+    - SubjectLogonId
+    - DSName
+  security_domain: endpoint
+tests:
+  - name: True Positive Test
+    attack_data:
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/aclmodification/windows-security-xml.log
+        source: XmlWinEventLog:Security
+        sourcetype: xmlwineventlog
@@ -0,0 +1,73 @@
+name: Windows AD Suspicious Attribute Modification
+id: 5682052e-ce55-4f9f-8d28-59191420b7e0
+version: 1
+date: '2023-11-13'
+author: Dean Luxton
+status: production
+type: TTP
+data_source:
+- Windows Security 5136
+description: >-
+  This detection monitors changes to the following Active Directory attributes: "msDS-AllowedToDelegateTo", "msDS-AllowedToActOnBehalfOfOtherIdentity", "msDS-KeyCredentialLink", "scriptPath", and "msTSInitialProgram". 
+  Modifications to these attributes can indicate potential malicious activity or privilege escalation attempts. Immediate investigation is recommended upon alert.
+search: >-
+  `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName IN ("msDS-AllowedToDelegateTo","msDS-AllowedToActOnBehalfOfOtherIdentity","scriptPath","msTSInitialProgram") OperationType=%%14674 
+  ```Changes to the attribute "msDS-KeyCredentialLink" are also worth moniroting, however tuning will need to be applied```
+  | table _time ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId DSName AttributeValue AttributeLDAPDisplayName 
+  | rename SubjectLogonId as TargetLogonId, src_user as initiator, _time as eventTime 
+  | appendpipe [| map search="search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$"] 
+  | stats min(eventTime) as _time values(initiator) as src_user, values(DSName) as targetDomain, values(ObjectDN) as ObjectDN, values(ObjectClass) as ObjectClass, values(src_category) as src_category, values(src_ip) as src_ip values(LogonType) as LogonType values(AttributeValue) as AttributeValue values(AttributeLDAPDisplayName) as AttributeLDAPDisplayName by TargetLogonId 
+  | rex field=ObjectDN "^CN=(?P<cn>.*?),[A-Z]{2}\=" 
+  | eval dest=if(ObjectClass="computer",cn,null), user=if(ObjectClass="user",cn,null)
+  | fields - cn
+  | `windows_ad_suspicious_attribute_modification_filter`
+how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. 
+  See lantern article in references for further on how to onboard AD audit data. Ensure the 
+  wineventlog_security macro is configured with the correct indexes. 
+known_false_positives: If key credentials are regularly assigned to users, these events will need to be tuned out. 
+references:
+- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a
+- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
+tags:
+  analytic_story:
+    - Sneaky Active Directory Persistence Tricks
+  asset_type: Endpoint
+  confidence: 100
+  impact: 100
+  message: $src_user$ has added $AttributeLDAPDisplayName$ ACL rights to $ObjectClass$ $ObjectDN$
+  mitre_attack_id:
+  - T1550
+  - T1222
+  - T1222.001
+  observable:
+    - name: src_user
+      type: User
+      role:
+        - Victim
+    - name: dest
+      type: Hostname
+      role:
+        - Victim
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  risk_score: 100
+  required_fields:
+    - _time
+    - OperationType
+    - ObjectDN
+    - OpCorrelationID
+    - src_user
+    - AttributeLDAPDisplayName
+    - AttributeValue
+    - ObjectClass
+    - SubjectLogonId
+    - DSName
+  security_domain: endpoint
+tests:
+  - name: True Positive Test
+    attack_data:
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/suspicious_acl_modification-windows-security-xml.log
+        source: XmlWinEventLog:Security
+        sourcetype: xmlwineventlog
@@ -0,0 +1,89 @@
+name: Windows AD Suspicious GPO Modification
+id: 0a2afc18-a3b5-4452-b60a-2e774214f9bf
+version: 1
+date: '2023-12-19'
+author: Dean Luxton
+status: experimental
+type: TTP
+data_source:
+- Windows Security 5136
+- Windows Security 5145
+description: This analytic looks for a the creation of potentially harmful GPO which could lead to persistence or code execution on remote hosts. 
+  Note, this analyic is looking for the absence of the corresponding 5136 events which is evidence of the GPOs being manually edited (using a tool like PowerView) or potentially missing logs. 
+search: >-
+    `wineventlog_security` EventCode=5145 ShareName="\\\\*\\SYSVOL" RelativeTargetName IN (*\\ScheduledTasks.xml, *\\Groups.xml, *\\Registry.xml, *\\Services.xml, *\\Scripts\\*) NOT RelativeTargetName=*\\Scripts\\scripts.ini AccessMask=0x2 
+    | rex field=AccessList max_match=0 "(?P<AccessList>%%\d+)" 
+    | table _time AccessMask src_ip src_user RelativeTargetName Logon_ID dvc 
+    | rex field=RelativeTargetName "Policies\\\(?P<gpo_guid>{.*?})\\\(?P<scope>\w+?)\\\(\w+)\\\(?P<folder>\w+)\\\(?P<file>\w+\.\w+)$"
+    | eval src=if(match(src_ip, "(?i)^fe80:"),dvc,src_ip), folder=case(RelativeTargetName like "%\\Scripts\\%","Scripts",folder="Groups","Local users and groups",1=1,folder)
+    | appendpipe 
+      [| map search="search `wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=gPCMachineExtensionNames $gpo_guid$" 
+      | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId 
+      | rex field=old_value max_match=10000 "(?P<old_values>\{.*?\})" 
+      | rex field=new_value max_match=10000 "(?P<new_values>\{.*?\})" 
+      | rex field=ObjectDN max_match=10000 "CN=(?P<policy_guid>\{.*?\})" 
+      | mvexpand new_values 
+      | where NOT new_values IN (old_values,"{00000000-0000-0000-0000-000000000000}",policy_guid) AND match(new_values, "^\{[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\}") 
+      | lookup msad_guid_lookup guid as new_values OUTPUTNEW displayName as policyType 
+      | eval newPolicy=if(policyType like "%",policyType,new_values) 
+      | stats values(OpCorrelationID) as OpCorrelationID values(newPolicy) as newPolicy by ObjectDN 
+      | rex field=ObjectDN max_match=10000 "CN=(?P<gpo_guid>\{.*?\})" 
+      | fields - ObjectDN] 
+    | stats values(AccessMask) as AccessMask values(src) as src values(src_user) as src_user values(RelativeTargetName) as RelativeTargetName values(Logon_ID) as Logon_ID values(newPolicy) as newPolicy values(OpCorrelationID) as OpCorrelationID values(folder) as folder values(file) as file by gpo_guid 
+    | mvexpand folder 
+    | where NOT folder IN (newPolicy)
+    | `windows_ad_suspicious_gpo_modification_filter`
+how_to_implement: Ingest EventCodes 5145 and 5136 from domain controllers. Additional SACLs required to capture EventCode 5136, see references for further information on how to configure this. 
+  The Group Policy - Audit Detailed File Share will need to be enabled on the DCs to generate event code 5145, this event is very noisy on DCs, consider tuning out sysvol events which do not match access mask 0x2.
+known_false_positives: When a GPO is manually edited and 5136 events are not logging to Splunk. 
+references:
+- https://github.com/PowerShellMafia/PowerSploit/blob/26a0757612e5654b4f792b012ab8f10f95d391c9/Recon/PowerView.ps1#L5907-L6122
+- https://github.com/X-C3LL/GPOwned
+- https://rastamouse.me/ous-and-gpos-and-wmi-filters-oh-my/
+- https://wald0.com/?p=179
+- https://github.com/FSecureLABS/SharpGPOAbuse
+- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
+tags:
+  analytic_story:
+    - Sneaky Active Directory Persistence Tricks
+  asset_type: Endpoint
+  confidence: 80
+  impact: 100
+  message: $src_user$ has added new GPO Client Side Extensions $folder$ to the policy $gpo_guid$
+  mitre_attack_id:
+  - T1484
+  - T1484.001
+  - T1222
+  - T1222.001
+  observable:
+    - name: user
+      type: User
+      role:
+        - Victim
+    - name: src_user
+      type: User
+      role:
+        - Victim
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  risk_score: 80
+  required_fields:
+    - _time
+    - OperationType
+    - ObjectDN
+    - OpCorrelationID
+    - src_user
+    - AttributeLDAPDisplayName
+    - AttributeValue
+    - ObjectClass
+    - SubjectLogonId
+    - DSName
+  security_domain: endpoint
+tests:
+  - name: True Positive Test
+    attack_data:
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/gpo_new_cse/windows-security.log
+        source: XmlWinEventLog:Security
+        sourcetype: xmlwineventlog
@@ -1,8 +1,8 @@
 name: Azure AD Global Administrator Role Assigned
 id: 825fed20-309d-4fd1-8aaf-cd49c1bb093c
-version: 6
-date: '2024-07-02'
-author: Gowthamaraj Rajendran, Mauricio Velazco, Dean Luxton, Splunk
+version: 5
+date: '2024-05-29'
+author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk
 status: production
 type: TTP
 description: The following analytic detects the assignment of the Azure AD Global
@@ -15,14 +15,11 @@ description: The following analytic detects the assignment of the Azure AD Globa
  posing a severe security risk.
 data_source:
 - Azure Active Directory Add member to role
-search: '`azure_monitor_aad`  operationName="Add member to role"  properties.targetResources{}.modifiedProperties{}.newValue="\"Global Administrator\""
-  | rename properties.* as *, initiatedBy.user.userPrincipalName as userPrincipalName, targetResources{}.displayName as displayName
-  | eval  initiatedBy = coalesce(userPrincipalName,src_user)
-  | eval user = coalesce(user,mvfilter(displayName!="null"))
-  | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user by initiatedBy, result, operationName
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `azure_ad_global_administrator_role_assigned_filter`'
+search: '`azure_monitor_aad`  operationName="Add member to role"  properties.targetResources{}.modifiedProperties{}.newValue="\"Global
+  Administrator\"" | rename properties.* as * | rename initiatedBy.user.userPrincipalName
+  as initiatedBy | stats count min(_time) as firstTime max(_time) as lastTime values(user)
+  as user by initiatedBy, result, operationName | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `azure_ad_global_administrator_role_assigned_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
  Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
  You must be ingesting Azure Active Directory events into your Splunk environment
@@ -1,8 +1,8 @@
 name: Azure AD Privileged Role Assigned
 id: a28f0bc3-3400-4a6e-a2da-89b9e95f0d2a
-version: 4
-date: '2024-07-02'
-author: Mauricio Velazco, Gowthamaraj Rajendran, Dean Luxton, Splunk
+version: 3
+date: '2024-05-29'
+author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
 description: The following analytic detects the assignment of privileged Azure Active
@@ -14,10 +14,8 @@ description: The following analytic detects the assignment of privileged Azure A
  over the Azure AD infrastructure.
 data_source:
 - Azure Active Directory Add member to role
-search: ' `azure_monitor_aad`  "operationName"="Add member to role" 
-  | rename properties.* as *, initiatedBy.user.userPrincipalName as userPrincipalName, targetResources{}.displayName as displayName
-  | eval  initiatedBy = coalesce(userPrincipalName,src_user)
-  | eval user = coalesce(user,mvfilter(displayName!="null"))
+search: ' `azure_monitor_aad`  "operationName"="Add member to role" | rename properties.*  as * 
+  | rename initiatedBy.user.userPrincipalName as initiatedBy 
  | rename targetResources{}.modifiedProperties{}.newValue  as roles 
  | eval role=mvindex(roles,1)
  | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user by initiatedBy, result, operationName, role
@@ -1,8 +1,8 @@
 name: Azure AD Service Principal New Client Credentials
 id: e3adc0d3-9e4b-4b5d-b662-12cec1adff2a
-version: 4
-date: '2024-07-02'
-author: Mauricio Velazco, Gowthamaraj Rajendran, Dean Luxton, Splunk
+version: 3
+date: '2024-05-11'
+author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
 description: The following analytic detects the addition of new credentials to Service
@@ -15,21 +15,11 @@ description: The following analytic detects the addition of new credentials to S
  access and control over the Azure environment.
 data_source:
 - Azure Active Directory
-search: ' `azure_monitor_aad`  category=AuditLogs operationName="Update application*Certificates and secrets management*"
- | rename properties.* as * 
- | rename  targetResources{}.* as * 
- | rename modifiedProperties{}.* as *
- | eval src_user=coalesce(user,identity), newValue=mvfilter(newValue!="\"KeyDescription\"")
- | stats count min(_time) as firstTime max(_time) as lastTime values(displayName) as displayName values(src_ip) as src_ip values(eval(mvfilter(oldValue!="null"))) as oldValue by src_user, object, newValue
- | spath input=oldValue output=oldValues path={}
- | spath input=newValue output=newValues path={}
- | mvexpand newValues
- | where NOT newValues IN (oldValues)
- | fields - newValue, oldValue, oldValues
- | rename newValues as newValue
- | `security_content_ctime(firstTime)` 
- | `security_content_ctime(lastTime)`
- | `azure_ad_service_principal_new_client_credentials_filter`'
+search: ' `azure_monitor_aad`  category=AuditLogs operationName="Update application*Certificates
+  and secrets management " | rename properties.* as * | rename  targetResources{}.*
+  as * | stats count min(_time) as firstTime max(_time) as lastTime values(displayName)
+  as displayName by user, modifiedProperties{}.newValue, src_ip | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `azure_ad_service_principal_new_client_credentials_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
  Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
  You must be ingesting Azure Active Directory events into your Splunk environment.
@@ -52,16 +42,12 @@ tags:
  asset_type: Azure Active Directory
  confidence: 50
  impact: 70
-  message: New Service Principal credentials were added to $object$ by $src_user$
+  message: New credentials added for Service Principal by $user$
  mitre_attack_id:
  - T1098
  - T1098.001
  observable:
-  - name: src_user
-    type: User
-    role:
-    - Victim
-  - name: object
+  - name: user
    type: User
    role:
    - Victim
@@ -1,7 +1,7 @@
 name: Detect New Local Admin account
 id: b25f6f62-0712-43c1-b203-083231ffd97d
-version: 5
-date: '2024-07-02'
+version: 4
+date: '2024-05-15'
 author: David Dorsey, Splunk
 status: production
 type: TTP
@@ -10,11 +10,10 @@ description: |-
 data_source:
 - Windows Event Log Security 4732 
 - Windows Event Log Security 4720
-search: '`wineventlog_security` (EventCode=4720) OR (EventCode=4732 Group_Name=Administrators) 
-| stats dc(EventCode) as evCount min(_time) as _time range(_time) as duration values(src_user) as src_user values(src_user_category) as src_user_category values(dest_category) as dest_category by user dest
-| where evCount=2
-| fields - evCount, duration
-| `detect_new_local_admin_account_filter`'
+search: '`wineventlog_security` EventCode=4720 OR (EventCode=4732 Group_Name=Administrators)
+  | transaction src_user connected=false maxspan=180m | rename src_user as user |
+  stats count min(_time) as firstTime max(_time) as lastTime by user dest | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `detect_new_local_admin_account_filter`'
 how_to_implement: You must be ingesting Windows event logs using the Splunk Windows
  TA and collecting event code 4720 and 4732
 known_false_positives: The activity may be legitimate. For this reason, it's best
@@ -40,10 +39,6 @@ tags:
    type: User
    role:
    - Victim
-  - name: src_user
-    type: User
-    role:
-    - Victim
  - name: dest
    type: Hostname
    role:
@@ -1,8 +1,8 @@
 name: Kerberos Pre-Authentication Flag Disabled in UserAccountControl
 id: 0cb847ee-9423-11ec-b2df-acde48001122
-version: 3
-date: '2024-07-02'
-author: Mauricio Velazco, Dean Luxton, Splunk
+version: 2
+date: '2024-05-24'
+author: Mauricio Velazco, Splunk
 status: production
 type: TTP
 description: The following analytic detects when the Kerberos Pre-Authentication flag
@@ -15,10 +15,9 @@ description: The following analytic detects when the Kerberos Pre-Authentication
  of sensitive information.
 data_source:
 - Windows Event Log Security 4738
-search: '`wineventlog_security` EventCode=4738 (UserAccountControl="%%2096" OR MSADChangedAttributes="*Don''t Require Preauth'' - Enabled*")
-  | eval MSADChangedAttributes="''Don''t Require Preauth'' - Enabled"
-  | table _time, source, EventCode, src_user, src_user_category, user, user_category, MSADChangedAttributes 
-  | `kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter`'
+search: ' `wineventlog_security` EventCode=4738 MSADChangedAttributes="*Don''t Require
+  Preauth'' - Enabled*" |rename Account_Name as user | table EventCode, user, dest,
+  Security_ID, MSADChangedAttributes | `kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
  Domain Controller events. The Advanced Security Audit policy setting `User Account
  Management` within `Account Management` needs to be enabled.
@@ -1,8 +1,8 @@
 name: Windows AD AdminSDHolder ACL Modified
 id: 00d877c3-7b7b-443d-9562-6b231e2abab9
-version: 2
-date: '2024-05-13'
-author: Mauricio Velazco, Splunk
+version: 3
+date: '2024-07-02'
+author: Mauricio Velazco, Dean Luxton, Splunk
 type: TTP
 status: production
 data_source:
@@ -15,10 +15,29 @@ description: The following analytic detects modifications to the Access Control
  can allow attackers to establish persistence and escalate privileges. If confirmed
  malicious, this could enable an attacker to control domain-level permissions, compromising
  the entire Active Directory environment.
-search: ' `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=nTSecurityDescriptor
-  OperationType="%%14674" ObjectDN="CN=AdminSDHolder,CN=System*" | rex field=AttributeValue
-  max_match=10000 "A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;(?P<added_user_sid>S-1-[0-59]-\d{2}-\d{8,10}-\d{8,10}-\d{8,10}-[1-9]\d{3})\)"
-  | stats values(added_user_sid) by _time, Computer, SubjectUserName, ObjectDN | `windows_ad_adminsdholder_acl_modified_filter`'
+search: >-
+  `wineventlog_security` EventCode=5136 ObjectClass=container ObjectDN="CN=AdminSDHolder,CN=System*" 
+  | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId 
+  | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)" 
+  | rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)" 
+  | mvexpand new_ace
+  | where NOT new_ace IN (old_values) 
+  | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$"
+  | rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})" 
+  | rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})" 
+  | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights
+  | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value 
+  | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value 
+  | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value
+  ``` Optional SID resolution lookups
+  | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user 
+  | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group```
+  | lookup builtin_groups_lookup builtin_group_string  as aceSid OUTPUTNEW builtin_group_name as builtin_group
+  | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid)
+  | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user user
+  | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights')
+  | search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP)
+  | `windows_ad_adminsdholder_acl_modified_filter`
 how_to_implement: To successfully implement this search, you ned to be ingesting eventcode
  `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes`
  within `DS Access` needs to be enabled. Additionally, a SACL needs to be created
@@ -33,24 +52,25 @@ references:
 - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136
 - https://learn.microsoft.com/en-us/windows/win32/secauthz/access-control-lists
 - https://medium.com/@cryps1s/detecting-windows-endpoint-compromise-with-sacls-cd748e10950
+- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
 tags:
  analytic_story:
  - Sneaky Active Directory Persistence Tricks
  asset_type: Endpoint
  confidence: 70
  impact: 80
-  message: The AdminSDHolder domain object has been modified on $Computer$ by $SubjectUserName$
+  message: The AdminSDHolder domain object $ObjectDN$ has been modified by $src_user$
  mitre_attack_id:
  - T1546
  observable:
-  - name: SubjectUserName
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: src_user
    type: User
    role:
    - Attacker
-  - name: Computer
-    type: Endpoint
-    role:
-    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -1,11 +1,12 @@
 name: Windows AD Domain Replication ACL Addition
 id: 8c372853-f459-4995-afdc-280c114d33ab
-version: 2
-date: "2024-05-16"
+version: 4
+date: "2024-08-08"
 author: Dean Luxton
 type: TTP
-status: experimental
-data_source: []
+status: production
+data_source:
+- Windows Security 5136
 description: The following analytic detects the addition of permissions required for
  a DCSync attack, specifically DS-Replication-Get-Changes, DS-Replication-Get-Changes-All,
  and DS-Replication-Get-Changes-In-Filtered-Set. It leverages EventCode 5136 from
@@ -14,14 +15,29 @@ description: The following analytic detects the addition of permissions required
  attack, which can be used to replicate AD objects and exfiltrate sensitive data.
  If confirmed malicious, an attacker could gain extensive access to Active Directory,
  leading to severe data breaches and privilege escalation.
-search: '`wineventlog_security`  | rex field=AttributeValue max_match=10000 "OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;(?P<DSRGetChangesFiltered_user_sid>S-1-[0-59]-\d{2}-\d{8,10}-\d{8,10}-\d{8,10}-[1-9]\d{3})\)"|
-  table _time dest src_user DSRGetChanges_user_sid DSRGetChangesAll_user_sid DSRGetChangesFiltered_user_sid|
-  mvexpand DSRGetChanges_user_sid| eval minDCSyncPermissions=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid,"true","false"),
-  fullSet=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid AND DSRGetChanges_user_sid=DSRGetChangesFiltered_user_sid,"true","false")|
-  where minDCSyncPermissions="true" | lookup identity_lookup_expanded  objectSid
-  as DSRGetChanges_user_sid OUTPUT sAMAccountName as user | rename DSRGetChanges_user_sid
-  as userSid | stats min(_time) as _time values(user) as user by dest src_user userSid
-  minDCSyncPermissions fullSet| `windows_ad_domain_replication_acl_addition_filter`'
+search: >-
+  `wineventlog_security` EventCode=5136 ObjectClass=domainDNS 
+  | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId 
+  | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)" 
+  | rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)" 
+  | mvexpand new_ace
+  | where NOT new_ace IN (old_values) 
+  | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);;(?P<aceSid>.*?)$"
+  | search aceObjectGuid IN ("1131f6aa-9c07-11d1-f79f-00c04fc2dcd2","1131f6ad-9c07-11d1-f79f-00c04fc2dcd2","89e95b76-444d-4c62-991a-0facbeda640c")
+  | rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})" 
+  | rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})" 
+  | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights
+  | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value 
+  | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value 
+  | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value
+  ``` Optional SID resolution lookups
+  | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user 
+  | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ```
+  | lookup builtin_groups_lookup builtin_group_string  as aceSid OUTPUT builtin_group_name as builtin_group
+  | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid)
+  | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user user
+  | search (aceControlAccessRights="DS-Replication-Get-Changes" AND aceControlAccessRights="DS-Replication-Get-Changes-All") OR (aceControlAccessRights="1131f6aa-9c07-11d1-f79f-00c04fc2dcd2" AND aceControlAccessRights="1131f6ad-9c07-11d1-f79f-00c04fc2dcd2")
+  | `windows_ad_domain_replication_acl_addition_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting
  the eventcode 5136. The Advanced Security Audit policy setting `Audit Directory
  Services Changes` within `DS Access` needs to be enabled, alongside a SACL for `everybody`
@@ -38,6 +54,7 @@ known_false_positives: When there is a change to nTSecurityDescriptor, Windows l
 references:
 - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb
 - https://github.com/SigmaHQ/sigma/blob/29a5c62784faf986dc03952ae3e90e3df3294284/rules/windows/builtin/security/win_security_account_backdoor_dcsync_rights.yml
+- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
 tags:
  analytic_story:
  - Sneaky Active Directory Persistence Tricks
@@ -56,17 +73,13 @@ tags:
    type: User
    role:
    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
-  - dest
+  - OperationType
  - src_user
  - AttributeLDAPDisplayName
  - AttributeValue
@@ -41,7 +41,6 @@ references:
 - https://adsecurity.org/?p=1729
 - https://www.linkedin.com/pulse/mimikatz-dcsync-event-log-detections-john-dwyer
 - https://github.com/SigmaHQ/sigma/blob/0.22-699-g29a5c6278/rules/windows/builtin/security/win_security_dcsync.yml
- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
 tags:
  analytic_story:
  - Sneaky Active Directory Persistence Tricks
@@ -45,7 +45,6 @@ references:
 - https://adsecurity.org/?p=1729
 - https://www.linkedin.com/pulse/mimikatz-dcsync-event-log-detections-john-dwyer
 - https://github.com/SigmaHQ/sigma/blob/0.22-699-g29a5c6278/rules/windows/builtin/security/win_security_dcsync.yml
- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
 tags:
  analytic_story:
  - Sneaky Active Directory Persistence Tricks
@@ -12,7 +12,7 @@ description: This analytic detects network share discovery and collection activi
  which can be a precursor to privilege escalation or data exfiltration. By monitoring Windows Event Logs for
  the usage of the Net command to list and interact with network shares, this detection helps identify potential reconnaissance and collection
  activities. 
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.user_category) as user_category values(Processes.user_bunit) as user_bunit  FROM datamodel=Endpoint.Processes WHERE (Processes.process_name="net.exe" OR Processes.process_name="net1.exe" OR Processes.orig_process_name="net.exe" OR Processes.orig_process_name="net1net[\s\.ex1]+view|net[\s\.ex1]+share|net[\s\.ex1]+use\s.exe") BY Processes.user Processes.dest Processes.process_exec Processes.parent_process_exec
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.user_category) as user_category values(Processes.user_bunit) as user_bunit  FROM datamodel=Endpoint.Processes WHERE (Processes.process_name="net.exe" OR Processes.process_name="net1.exe" OR Processes.orig_process_name="net.exe" OR Processes.orig_process_name="net1.exe") BY Processes.user Processes.dest Processes.process_exec Processes.parent_process_exec
  Processes.process Processes.parent_process
  | `drop_dm_object_name(Processes)`
  | regex process="net[\s\.ex1]+view|net[\s\.ex1]+share|net[\s\.ex1]+use\s"
@@ -0,0 +1,14 @@
+access_rights_string,access_rights_value
+RC,Read permissions
+SD,Delete
+WD,Modify permissions
+WO,Modify owner
+RP,Read all properties
+WP,Write all properties
+CC,Create all child objects
+DC,Delete all child objects
+LC,List contents
+SW,All validated writes
+LO,List objects
+DT,Delete subtree
+CR,All extended rights
@@ -0,0 +1,3 @@
+description: A lookup file that will contain translations for AD object ace access rights strings
+filename: ace_access_rights_lookup.csv
+name: ace_access_rights_lookup
@@ -0,0 +1,10 @@
+flag_string,flag_value
+CI,Container inherit
+OI,Object inherit
+NP,No propagate
+IO,Inherit only
+ID,Inherited
+SA,Audit success
+FA,Audit failure
+TP,Trust protected filter
+CR,Critical
@@ -0,0 +1,3 @@
+description: A lookup file that will contain translations for AD object ace flags strings
+filename: ace_flag_lookup.csv
+name: ace_flag_lookup
@@ -0,0 +1,18 @@
+ace_type_string,ace_type_value
+A,Access allowed
+D,Access denied
+OA,Object access allowed
+OD,Object access denied
+AU,Audit
+AL,Alarm
+OU,Object audit
+OL,Object alarm
+ML,Mandatory label
+XA,Callback access allowed
+XD,Callback access denied
+RA,Resource attribute
+SP,Scoped policy ID
+XU,Callback audit
+ZA,Callback object access allowed
+TL,Process trust label
+FL,Access filter
@@ -0,0 +1,3 @@
+description: A lookup file that will contain translations for AD object ace type strings
+filename: ace_type_lookup.csv
+name: ace_type_lookup
@@ -0,0 +1,39 @@
+builtin_group_string,builtin_group_name
+AO,Account operators
+RU,Alias to allow previous Windows 2000
+AN,Anonymous logon
+AU,Authenticated users
+BA,Built-in administrators
+BG,Built-in guests
+BO,Backup operators
+BU,Built-in users
+CA,Certificate server administrators
+CG,Creator group
+CO,Creator owner
+DA,Domain administrators
+DC,Domain computers
+DD,Domain controllers
+DG,Domain guests
+DU,Domain users
+EA,Enterprise administrators
+ED,Enterprise domain controllers
+WD,Everyone
+PA,Group Policy administrators
+IU,Interactively logged-on user
+LA,Local administrator
+LG,Local guest
+LS,Local service account
+SY,Local system
+NU,Network sign-in user
+NO,Network configuration operators
+NS,Network service account
+PO,Printer operators
+PS,Personal self
+PU,Power users
+RS,RAS servers group
+RD,Terminal server users
+RE,Replicator
+RC,Restricted code
+SA,Schema administrators
+SO,Server operators
+SU,Service sign-in user
@@ -0,0 +1,3 @@
+description: A lookup file that will contain translations for builtin AD group strings
+filename: builtin_groups_lookup.csv
+name: builtin_groups_lookup
@@ -0,0 +1,3 @@
+description: A lookup file that will contain translations for AD object ace control access rights guids
+filename: msad_guid_lookup.csv
+name: msad_guid_lookup