From 05ee57946953aa533d3ced48e46ba375e52dd248 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Tue, 2 Jul 2024 11:52:21 +1000 Subject: [PATCH 01/15] adding AD ACL and GPO related detections --- ...ows_ad_dangerous_deny_acl_modification.yml | 82 + ...ws_ad_dangerous_group_acl_modification.yml | 83 + ...ows_ad_dangerous_user_acl_modification.yml | 83 + ...ws_ad_dcshadow_privileges_acl_addition.yml | 85 + .../windows_ad_domain_root_acl_deletion.yml | 82 + ...indows_ad_domain_root_acl_modification.yml | 82 + .../application/windows_ad_gpo_deleted.yml | 62 + .../application/windows_ad_gpo_disabled.yml | 57 + .../windows_ad_gpo_new_cse_addition.yml | 72 + .../windows_ad_hidden_ou_creation.yml | 81 + .../windows_ad_object_owner_updated.yml | 76 + ...ndows_ad_privileged_group_modification.yml | 54 + .../windows_ad_self_dacl_assignment.yml | 76 + ...s_ad_suspicious_attribute_modification.yml | 71 + ...windows_ad_suspicious_gpo_modification.yml | 89 + .../windows_ad_adminsdholder_acl_modified.yml | 34 +- ...ows_ad_domain_replication_acl_addition.yml | 47 +- lookups/ace_access_rights_lookup.csv | 14 + lookups/ace_access_rights_lookup.yml | 3 + lookups/ace_flag_lookup.csv | 10 + lookups/ace_flag_lookup.yml | 3 + lookups/ace_type_lookup.csv | 18 + lookups/ace_type_lookup.yml | 3 + lookups/builtin_groups_lookup.csv | 39 + lookups/builtin_groups_lookup.yml | 3 + lookups/msad_guid_lookup.csv | 1678 +++++++++++++++++ lookups/msad_guid_lookup.yml | 3 + 27 files changed, 2966 insertions(+), 24 deletions(-) create mode 100644 detections/application/windows_ad_dangerous_deny_acl_modification.yml create mode 100644 detections/application/windows_ad_dangerous_group_acl_modification.yml create mode 100644 detections/application/windows_ad_dangerous_user_acl_modification.yml create mode 100644 detections/application/windows_ad_dcshadow_privileges_acl_addition.yml create mode 100644 detections/application/windows_ad_domain_root_acl_deletion.yml create mode 100644 detections/application/windows_ad_domain_root_acl_modification.yml create mode 100644 detections/application/windows_ad_gpo_deleted.yml create mode 100644 detections/application/windows_ad_gpo_disabled.yml create mode 100644 detections/application/windows_ad_gpo_new_cse_addition.yml create mode 100644 detections/application/windows_ad_hidden_ou_creation.yml create mode 100644 detections/application/windows_ad_object_owner_updated.yml create mode 100644 detections/application/windows_ad_privileged_group_modification.yml create mode 100644 detections/application/windows_ad_self_dacl_assignment.yml create mode 100644 detections/application/windows_ad_suspicious_attribute_modification.yml create mode 100644 detections/application/windows_ad_suspicious_gpo_modification.yml create mode 100644 lookups/ace_access_rights_lookup.csv create mode 100644 lookups/ace_access_rights_lookup.yml create mode 100644 lookups/ace_flag_lookup.csv create mode 100644 lookups/ace_flag_lookup.yml create mode 100644 lookups/ace_type_lookup.csv create mode 100644 lookups/ace_type_lookup.yml create mode 100644 lookups/builtin_groups_lookup.csv create mode 100644 lookups/builtin_groups_lookup.yml create mode 100644 lookups/msad_guid_lookup.csv create mode 100644 lookups/msad_guid_lookup.yml diff --git a/detections/application/windows_ad_dangerous_deny_acl_modification.yml b/detections/application/windows_ad_dangerous_deny_acl_modification.yml new file mode 100644 index 0000000000..9cf52b9a54 --- /dev/null +++ b/detections/application/windows_ad_dangerous_deny_acl_modification.yml @@ -0,0 +1,82 @@ +name: Windows AD Dangerous Deny ACL Modification +id: 8e897153-2ebd-4cb2-85d3-09ad57db2fb7 +version: 1 +date: '2023-11-21' +author: Dean Luxton +status: production +type: TTP +data_source: +- Windows Security 5136 +description: ACL modification event denying the ability to enumerate permissions. +search: >- + `wineventlog_security` EventCode=5136 + | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId + | rex field=old_value max_match=10000 "\((?P.*?)\)" + | rex field=new_value max_match=10000 "\((?P.*?)\)" + | mvexpand new_ace + | where NOT new_ace IN (old_values) + | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" + | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" + | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" + | lookup msad_guid_lookup.csv guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup ace_access_rights_lookup.csv access_rights_string as AccessRights OUTPUT access_rights_value + | lookup ace_type_lookup.csv ace_type_string as aceType OUTPUT ace_type_value as aceType + | lookup ace_flag_lookup.csv flag_string as aceFlags OUTPUT flag_value as ace_flag_value + ``` Optional SID resolution lookups + | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user + | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` + | lookup builtin_groups_lookup.csv builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) + | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID + | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') + | search aceType IN ("Access denied",D) AND aceAccessRights IN ("Full control","Read permissions",RC) + | `windows_ad_dangerous_deny_acl_modification_filter` +how_to_implement: See link in references for how to configure logging for these eventcodes. Include lookups for SID resolution if evt_resolve_ad_obj is set to 0. +known_false_positives: None. +references: +- https://happycamper84.medium.com/sneaky-persistence-via-hidden-objects-in-ad-1c91fc37bf54 +- https://www.youtube.com/watch?v=_nGpZ1ydzS8 +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +tags: + analytic_story: + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + confidence: 100 + impact: 100 + message: $src_user$ has added ACL rights to deny $user$ $aceControlAccessRights$ $aceAccessRights$ to $ObjectDN$ + mitre_attack_id: + - T1484 + - T1222 + - T1222.001 + observable: + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 100 + required_fields: + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/hidden_object_windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/application/windows_ad_dangerous_group_acl_modification.yml b/detections/application/windows_ad_dangerous_group_acl_modification.yml new file mode 100644 index 0000000000..c2bdd58151 --- /dev/null +++ b/detections/application/windows_ad_dangerous_group_acl_modification.yml @@ -0,0 +1,83 @@ +name: Windows AD Dangerous Group ACL Modification +id: 59b0fc85-7a0d-4585-97ec-06a382801990 +version: 1 +date: '2023-11-13' +author: Dean Luxton +status: production +type: TTP +data_source: +- Windows Security 5136 +description: Group ACL modification event with potentially dangerous permissions applied. +search: >- + `wineventlog_security` EventCode=5136 ObjectClass=group + | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId + | rex field=old_value max_match=10000 "\((?P.*?)\)" + | rex field=new_value max_match=10000 "\((?P.*?)\)" + | mvexpand new_ace + | where NOT new_ace IN (old_values) + | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" + | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" + | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" + | lookup ace_type_lookup.csv ace_type_string as aceType OUTPUT ace_type_value as aceType + | lookup ace_flag_lookup.csv flag_string as aceFlags OUTPUT flag_value as ace_flag_value + | lookup ace_access_rights_lookup.csv access_rights_string as AccessRights OUTPUT access_rights_value + | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + ``` Optional SID resolution lookups + | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user + | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` + | lookup builtin_groups_lookup.csv builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | eval aceType=coalesce(ace_type_value,aceType), aceInheritance=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)), user=coalesce(user, group, builtin_group, aceSid) + | stats values(aceType) as aceType values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID + | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') + | search NOT aceType IN ("*denied*","D","OD","XD") AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) + | `windows_ad_dangerous_group_acl_modification_filter` +how_to_implement: See link in references for how to configure logging for these eventcodes. Include lookups for SID resolution if evt_resolve_ad_obj is set to 0. +known_false_positives: Unknown +references: +- https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings +- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb +- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +tags: + analytic_story: + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + confidence: 100 + impact: 100 + message: $src_user$ has added ACL rights to grant $user$ $aceControlAccessRights$ $aceAccessRights$ to group $ObjectDN$ + mitre_attack_id: + - T1484 + - T1222 + - T1222.001 + observable: + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 100 + required_fields: + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/group_dacl_mod_windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/application/windows_ad_dangerous_user_acl_modification.yml b/detections/application/windows_ad_dangerous_user_acl_modification.yml new file mode 100644 index 0000000000..7e99d1c55f --- /dev/null +++ b/detections/application/windows_ad_dangerous_user_acl_modification.yml @@ -0,0 +1,83 @@ +name: Windows AD Dangerous User ACL Modification +id: ec5b6790-595a-4fb8-ad43-56e5b55a9617 +version: 1 +date: '2023-11-15' +author: Dean Luxton +status: production +type: TTP +data_source: +- Windows Security 5136 +description: User ACL modification event with potentially dangerous permissions applied. +search: >- + `wineventlog_security` EventCode=5136 ObjectClass=user + | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId + | rex field=old_value max_match=10000 "\((?P.*?)\)" + | rex field=new_value max_match=10000 "\((?P.*?)\)" + | mvexpand new_ace + | where NOT new_ace IN (old_values) + | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" + | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" + | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" + | lookup msad_guid_lookup.csv guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup ace_access_rights_lookup.csv access_rights_string as AccessRights OUTPUT access_rights_value + | lookup ace_type_lookup.csv ace_type_string as aceType OUTPUT ace_type_value as aceType + | lookup ace_flag_lookup.csv flag_string as aceFlags OUTPUT flag_value as ace_flag_value + ``` Optional SID resolution lookups + | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user + | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` + | lookup builtin_groups_lookup.csv builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) + | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID + | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') + | search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) + | `windows_ad_dangerous_user_acl_modification_filter` +how_to_implement: See link in references for how to configure logging for these eventcodes. Include lookups for SID resolution if evt_resolve_ad_obj is set to 0. +known_false_positives: Unknown +references: +- https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings +- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb +- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +tags: + analytic_story: + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + confidence: 100 + impact: 100 + message: $src_user$ has added ACL rights to grant $user$ $aceControlAccessRights$ $aceAccessRights$ to user $ObjectDN$ + mitre_attack_id: + - T1484 + - T1222 + - T1222.001 + observable: + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 100 + required_fields: + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/user_dacl_mod_windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml b/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml new file mode 100644 index 0000000000..8a3c15a9e0 --- /dev/null +++ b/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml @@ -0,0 +1,85 @@ +name: Windows AD DCShadow ACL Addition +id: ae915743-1aa8-4a94-975c-8062ebc8b723 +version: 1 +date: '2023-11-10' +author: Dean Luxton +status: production +type: TTP +data_source: +- Windows Security 5136 +description: Detect ACL modification event applying the minimum required extended rights to perform a DCShadow attack. +search: >- + `wineventlog_security` EventCode=5136 ObjectClass=domainDNS + | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId + | rex field=old_value max_match=10000 "\((?P.*?)\)" + | rex field=new_value max_match=10000 "\((?P.*?)\)" + | mvexpand new_ace + | where NOT new_ace IN (old_values) + | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" + | search aceObjectGuid IN ("9923a32a-3607-11d2-b9be-0000f87a36b2","1131f6ab-9c07-11d1-f79f-00c04fc2dcd2","1131f6ac-9c07-11d1-f79f-00c04fc2dcd2") + | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" + | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" + | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup ace_access_rights_lookup.csv access_rights_string as AccessRights OUTPUT access_rights_value + | lookup ace_type_lookup.csv ace_type_string as aceType OUTPUT ace_type_value + | lookup ace_flag_lookup.csv flag_string as aceFlags OUTPUT flag_value as ace_flag_value + ``` Optional SID resolution lookups + | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user + | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` + | lookup builtin_groups_lookup.csv builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) + | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user user + | search (aceControlAccessRights="DS-Install-Replica" AND aceControlAccessRights="DS-Replication-Manage-Topology" AND aceControlAccessRights="DS-Replication-Synchronize") OR (aceControlAccessRights="9923a32a-3607-11d2-b9be-0000f87a36b2" AND aceControlAccessRights="1131f6ab-9c07-11d1-f79f-00c04fc2dcd2" AND aceControlAccessRights="1131f6ac-9c07-11d1-f79f-00c04fc2dcd2") + | `windows_ad_dcshadow_acl_addition_filter` +how_to_implement: See link in references for how to configure logging for these eventcodes. +known_false_positives: Unknown +references: +- https://www.labofapenetrationtester.com/2018/04/dcshadow.html +- https://github.com/samratashok/nishang/blob/master/ActiveDirectory/Set-DCShadowPermissions.ps1 +- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +tags: + analytic_story: + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + confidence: 100 + impact: 100 + message: $targetDomain$ ACL modification Event Initiated by $src_user$ applying $user$ the minimum required extended rights to perform a DCShadow attack. + mitre_attack_id: + - T1484 + - T1207 + - T1222.001 + observable: + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim + - name: src_ip + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 100 + required_fields: + - _time + - OperationType + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/DCShadowPermissions/windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/application/windows_ad_domain_root_acl_deletion.yml b/detections/application/windows_ad_domain_root_acl_deletion.yml new file mode 100644 index 0000000000..fa0476aa2a --- /dev/null +++ b/detections/application/windows_ad_domain_root_acl_deletion.yml @@ -0,0 +1,82 @@ +name: Windows AD Domain Root ACL Deletion +id: 3cb56e57-5642-4638-907f-8dfde9afb889 +version: 1 +date: '2023-11-13' +author: Dean Luxton +status: production +type: TTP +data_source: +- Windows Security 5136 +description: ACL deletion performed on the domain root object, significant AD change with high impact. Following MS guidance all changes at this level should be reviewed. Drill into the logonID within EventCode 4624 for information on the source device during triage. +search: >- + `wineventlog_security` EventCode=5136 ObjectClass=domainDNS + | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId + | rex field=old_value max_match=10000 "\((?P.*?)\)" + | rex field=new_value max_match=10000 "\((?P.*?)\)" + | mvexpand old_values + | where NOT old_values IN (new_values) + | rex field=old_values "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" + | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" + | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" + | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup ace_access_rights_lookup.csv access_rights_string as AccessRights OUTPUT access_rights_value + | lookup ace_type_lookup.csv ace_type_string as aceType OUTPUT ace_type_value + | lookup ace_flag_lookup.csv flag_string as aceFlags OUTPUT flag_value as ace_flag_value + ``` Optional SID resolution lookups + | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user + | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` + | lookup builtin_groups_lookup.csv builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) + | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(old_values) as old_values by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID + | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') + | `windows_ad_domain_root_acl_deletion_filter` +how_to_implement: See link in references for how to configure logging for these eventcodes. Include lookups for SID resolution if evt_resolve_ad_obj is set to 0. +known_false_positives: Unknown +references: +- https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings +- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb +- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +tags: + analytic_story: + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + confidence: 100 + impact: 100 + message: $src_user$ has removed $user$ $aceAccessRights$ ACL rights to domain root $ObjectDN$ + mitre_attack_id: + - T1484 + - T1222 + - T1222.001 + observable: + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 100 + required_fields: + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/domain_root_acl_deletion_windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/application/windows_ad_domain_root_acl_modification.yml b/detections/application/windows_ad_domain_root_acl_modification.yml new file mode 100644 index 0000000000..875a34656a --- /dev/null +++ b/detections/application/windows_ad_domain_root_acl_modification.yml @@ -0,0 +1,82 @@ +name: Windows AD Domain Root ACL Modification +id: 4981e2db-1372-440d-816e-3e7e2ed74433 +version: 1 +date: '2023-11-11' +author: Dean Luxton +status: production +type: TTP +data_source: +- Windows Security 5136 +description: ACL modification performed on the domain root object, significant AD change with high impact. Following MS guidance all changes at this level should be reviewed. Drill into the logonID within EventCode 4624 for information on the source device during triage. +search: >- + `wineventlog_security` EventCode=5136 ObjectClass=domainDNS + | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId + | rex field=old_value max_match=10000 "\((?P.*?)\)" + | rex field=new_value max_match=10000 "\((?P.*?)\)" + | mvexpand new_ace + | where NOT new_ace IN (old_values) + | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" + | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" + | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" + | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup ace_access_rights_lookup.csv access_rights_string as AccessRights OUTPUT access_rights_value + | lookup ace_type_lookup.csv ace_type_string as aceType OUTPUT ace_type_value + | lookup ace_flag_lookup.csv flag_string as aceFlags OUTPUT flag_value as ace_flag_value + ``` Optional SID resolution lookups + | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user + | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` + | lookup builtin_groups_lookup.csv builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | eval aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",'access_rights_value'), aceType=ace_type_value, aceFlags=coalesce(ace_flag_value,"This object only"), aceControlAccessRights=ControlAccessRights, user=coalesce(user, group, builtin_group, aceSid) + | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID + | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') + | `windows_ad_domain_root_acl_modification_filter` +how_to_implement: See link in references for how to configure logging for these eventcodes. Include lookups for SID resolution if evt_resolve_ad_obj is set to 0. +known_false_positives: Unknown +references: +- https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings +- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb +- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +tags: + analytic_story: + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + confidence: 100 + impact: 100 + message: $src_user$ has granted $user$ $aceAccessRights$ ACL rights to domain root $ObjectDN$ + mitre_attack_id: + - T1484 + - T1222 + - T1222.001 + observable: + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 100 + required_fields: + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/domain_root_acl_mod_windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/application/windows_ad_gpo_deleted.yml b/detections/application/windows_ad_gpo_deleted.yml new file mode 100644 index 0000000000..925c0d625e --- /dev/null +++ b/detections/application/windows_ad_gpo_deleted.yml @@ -0,0 +1,62 @@ +name: Windows AD GPO Deleted +id: 0d41772b-35ab-4e1c-a2ba-d0b455481aee +version: 1 +date: '2023-11-24' +author: Dean Luxton +status: production +type: TTP +data_source: +- Windows Security 5136 +description: Windows AD Group Policy Object Deleted +search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=gpLink | eval ObjectDN=upper(ObjectDN) + | stats min(_time) as eventTime values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(src_user) as src_user by OpCorrelationID ObjectDN SubjectLogonId + | rex field=old_value max_match=10000 "(?i)LDAP://(?Pcn.*?);(?P\d)\]" + | rex field=new_value max_match=10000 "(?i)LDAP://(?Pcn.*?);(?P\d)\]" + | mvexpand old_dn + | where NOT old_dn IN (new_dn) + | eval ObjectDN=upper(old_dn) + | join ObjectDN type=outer [| search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update | eval ObjectDN=upper(distinguishedName) | stats latest(displayName) as displayName by ObjectDN ] + | stats min(eventTime) as _time values(OpCorrelationID) as OpCorrelationID values(displayName) as policyName values(src_user) as src_user by ObjectDN SubjectLogonId + | `windows_ad_gpo_deleted_filter`' +how_to_implement: Ensure you are ingesting AD audit logs, see lantern doc in references for further details. This detection also leverages admon data. Ensure the admon macro is configured with the correct index. +known_false_positives: Unknown +references: +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +tags: + analytic_story: + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + confidence: 80 + impact: 80 + message: GPO $policyName$ was deleted by $src_user$ + mitre_attack_id: + - T1562.001 + - T1484.001 + observable: + - name: src_user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 64 + required_fields: + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_created/gpo_deletion_windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/application/windows_ad_gpo_disabled.yml b/detections/application/windows_ad_gpo_disabled.yml new file mode 100644 index 0000000000..290a148efa --- /dev/null +++ b/detections/application/windows_ad_gpo_disabled.yml @@ -0,0 +1,57 @@ +name: Windows AD GPO Disabled +id: 72793bc0-c0cd-400e-9e60-fdf36f278917 +version: 1 +date: '2023-11-24' +author: Dean Luxton +status: production +type: TTP +data_source: +- Windows Security 5136 +description: Windows AD Group Policy Object Disabled +search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=flags OperationType="%%14674" AttributeValue!=0 + | eval AttributeValueExp=case(AttributeValue==0,"Enabled",AttributeValue==1,"User configuration settings disabled",AttributeValue==2,"Computer configuration settings disabled",AttributeValue==3,"Disabled"), ObjectDN=upper(ObjectDN) + | join ObjectDN type=outer [| search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update | eval ObjectDN=upper(distinguishedName) | stats latest(displayName) as displayName by ObjectDN ] + | stats min(_time) as _time values(AttributeValue) as AttributeValue values(AttributeValueExp) as AttributeValueExp values(OpCorrelationID) as OpCorrelationID values(displayName) as policyName values(src_user) as src_user by ObjectDN SubjectLogonId + | `windows_ad_gpo_disabled_filter`' +how_to_implement: Ensure you are ingesting AD audit logs, see lantern doc in references for further details. This detection also leverages admon data. Ensure the admon macro is configured with the correct index. +known_false_positives: Unknown +references: +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +tags: + analytic_story: + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + confidence: 80 + impact: 80 + message: $src_user$ has disabled GPO $policyName$ + mitre_attack_id: + - T1562.001 + - T1484.001 + observable: + - name: src_user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 64 + required_fields: + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_created/gpo_disabled_windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/application/windows_ad_gpo_new_cse_addition.yml b/detections/application/windows_ad_gpo_new_cse_addition.yml new file mode 100644 index 0000000000..512be6b2bc --- /dev/null +++ b/detections/application/windows_ad_gpo_new_cse_addition.yml @@ -0,0 +1,72 @@ +name: Windows AD GPO New CSE Addition +id: 700c11d1-da09-47b2-81aa-358c143c7986 +version: 1 +date: '2023-11-22' +author: Dean Luxton +status: production +type: TTP +data_source: +- Windows Security 5136 +description: New Client Side Extension added to a Group Policy Object. +search: '`wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=gPCMachineExtensionNames + | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId + | rex field=old_value max_match=10000 "(?P\{.*?\})" + | rex field=new_value max_match=10000 "(?P\{.*?\})" + | rex field=ObjectDN max_match=10000 "CN=(?P\{.*?\})" + | mvexpand new_values + | where NOT new_values IN (old_values,"{00000000-0000-0000-0000-000000000000}",policy_guid) AND match(new_values, "^\{[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\}") + | lookup msad_guid_lookup.csv guid as new_values OUTPUTNEW displayName as policyType + | eval newPolicy=if(policyType like "%",policyType,new_values) + | join ObjectDN [| search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update | stats latest(displayName) as displayName by distinguishedName | eval ObjectDN=upper(distinguishedName)] + | stats values(OpCorrelationID) as OpCorrelationID values(src_user) as src_user values(SubjectLogonId) as SubjectLogonId values(newPolicy) as newPolicy values(displayName) as policyName by ObjectDN + | `windows_ad_gpo_new_cse_addition_filter`' +how_to_implement: Ensure you are ingesting AD audit logs, see lantern doc in references for further details. This detection also leverages admon data. Ensure the admon macro is configured with the correct index. +known_false_positives: Genuine GPO uage +references: +- https://wald0.com/?p=179 +- https://learn.microsoft.com/en-gb/archive/blogs/mempson/group-policy-client-side-extension-list +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +tags: + analytic_story: + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + confidence: 100 + impact: 100 + message: $src_user$ has added new GPO Client Side Extensions $newPolicy$ to the policy $policyName$ + mitre_attack_id: + - T1484 + - T1484.001 + - T1222 + - T1222.001 + observable: + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 100 + required_fields: + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_created/gpo_new_cse_windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/application/windows_ad_hidden_ou_creation.yml b/detections/application/windows_ad_hidden_ou_creation.yml new file mode 100644 index 0000000000..ef2e23e250 --- /dev/null +++ b/detections/application/windows_ad_hidden_ou_creation.yml @@ -0,0 +1,81 @@ +name: Windows AD Hidden OU Creation +id: 66b6ad5e-339a-40af-b721-dacefc7bdb75 +version: 1 +date: '2023-11-16' +author: Dean Luxton +status: production +type: TTP +data_source: +- Windows Security 5136 +description: This analytic is looking for when an ACL is applied to an OU which denies listing the objects residing in the OU. This activity combined with modifying the owner of the OU will hide AD objects even from domain administrators. +search: >- + `wineventlog_security` EventCode=5136 ObjectClass=organizationalUnit + | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId + | rex field=old_value max_match=10000 "\((?P.*?)\)" + | rex field=new_value max_match=10000 "\((?P.*?)\)" + | mvexpand new_ace + | where NOT new_ace IN (old_values) + | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" + | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" + | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" + | lookup msad_guid_lookup.csv guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup ace_access_rights_lookup.csv access_rights_string as AccessRights OUTPUT access_rights_value + | lookup ace_type_lookup.csv ace_type_string as aceType OUTPUT ace_type_value as aceType + | lookup ace_flag_lookup.csv flag_string as aceFlags OUTPUT flag_value as ace_flag_value + ``` Optional SID resolution lookups + | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user + | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` + | lookup builtin_groups_lookup.csv builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) + | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID + | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') + | search aceType IN ("Access denied",D) AND aceAccessRights IN ("List contents","List objects",LC,LO) + | `windows_ad_hidden_ou_creation_filter` +how_to_implement: See link in references for how to configure logging for these eventcodes. Include lookups for SID resolution if evt_resolve_ad_obj is set to 0. +known_false_positives: None. +references: +- https://happycamper84.medium.com/sneaky-persistence-via-hidden-objects-in-ad-1c91fc37bf54 +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +tags: + analytic_story: + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + confidence: 100 + impact: 100 + message: $src_user$ has hidden the contents of OU $ObjectDN$ from $user$ + mitre_attack_id: + - T1484 + - T1222 + - T1222.001 + observable: + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 100 + required_fields: + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/hidden_ou_windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/application/windows_ad_object_owner_updated.yml b/detections/application/windows_ad_object_owner_updated.yml new file mode 100644 index 0000000000..16609a4a95 --- /dev/null +++ b/detections/application/windows_ad_object_owner_updated.yml @@ -0,0 +1,76 @@ +name: Windows AD Object Owner Updated +id: 4af01f6b-d8d4-4f96-8635-758a01557130 +version: 1 +date: '2023-11-13' +author: Dean Luxton +status: production +type: TTP +data_source: +- Windows Security 5136 +description: AD Object Owner Updated. The owner provides Full control level privileges over the target AD Object. This event has significant impact alone and is also a precursor activity for hiding an AD object. +search: ' `wineventlog_security` EventCode=5136 + | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId DSName + | rex field=old_value "O:(?P.*?)G:" + | rex field=new_value "O:(?P.*?)G:" + | where old_owner!=new_owner + ``` optional SID resolution lookups + | lookup identity_lookup_expanded objectSid as new_owner OUTPUT downLevelDomainName as new_owner_user + | lookup admon_groups_def objectSid as new_owner OUTPUT cn as new_owner_group + | lookup identity_lookup_expanded objectSid as old_owner OUTPUT downLevelDomainName as old_owner_user + | lookup admon_groups_def objectSid as old_owner OUTPUT cn as old_owner_group + ``` + | lookup builtin_groups_lookup.csv builtin_group_string as new_owner_group OUTPUT builtin_group_name as new_owner_group_builtin_group + | lookup builtin_groups_lookup.csv builtin_group_string as old_owner OUTPUT builtin_group_name as old_owner_group_builtin_group + | eval user=coalesce(new_owner_user, new_owner_group, new_owner_group_builtin_group, new_owner), previousOwner=coalesce(old_owner_user, old_owner_group, old_owner_group_builtin_group, old_owner) + | stats values(previousOwner) as previousOwner values(user) as user values(SubjectLogonId) as SubjectLogonId by _time ObjectClass ObjectDN src_user OpCorrelationID DSName + | `windows_ad_object_owner_updated_filter`' +how_to_implement: This analytic leverages event code 5136, see documentation in references on how to enable logging. +known_false_positives: Unknown +references: +- https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings +- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb +- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +tags: + analytic_story: + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + confidence: 100 + impact: 100 + message: $src_user$ has made $user$ the owner of AD object $ObjectDN$ + mitre_attack_id: + - T1484 + - T1222 + - T1222.001 + observable: + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 100 + required_fields: + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/owner_updated_windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/application/windows_ad_privileged_group_modification.yml b/detections/application/windows_ad_privileged_group_modification.yml new file mode 100644 index 0000000000..efd0127f03 --- /dev/null +++ b/detections/application/windows_ad_privileged_group_modification.yml @@ -0,0 +1,54 @@ +name: Windows AD Privileged Group Modification +id: 187bf937-c436-4c65-bbcb-7539ffe02da1 +version: 1 +date: '2023-09-27' +author: Dean Luxton +status: experimental +type: TTP +data_source: +- XmlWinEventLog:Security +description: Detect users added to privileged AD Groups. +search: '`wineventlog_security` EventCode IN (4728) + | stats min(_time) as _time dc(user) as usercount, values(user) as user values(user_category) as user_category values(src_user_category) as src_user_category values(dvc) as dvc by signature, Group_Name,src_user + | lookup admon_groups_def cn as Group_Name OUTPUT category + | where category="privileged" | `windows_ad_privileged_group_modification`' +how_to_implement: This analytic requires eventCode 4728 to be ingested along with the admon_groups_def lookup being configured to include a list of AD groups along with a category to identify privileged groups. + See splunkbase app listed in the references for further details. +known_false_positives: None +references: +- https://splunkbase.splunk.com/app/6853 +tags: + analytic_story: + - Active Directory Privilege Escalation + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + confidence: 100 + impact: 50 + message: $user$ was added to privileged AD Group $Group_Name$ by $src_user$ + mitre_attack_id: + - T1098 + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 50 + required_fields: + - EventCode + - user + - src_user + - signature + - Group_Name + - dest + security_domain: identity + manual_test: This search uses a lookup provided by Enterprise Security and needs to be manually tested. +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/detections/application/windows_ad_self_dacl_assignment.yml b/detections/application/windows_ad_self_dacl_assignment.yml new file mode 100644 index 0000000000..bfc00b4eba --- /dev/null +++ b/detections/application/windows_ad_self_dacl_assignment.yml @@ -0,0 +1,76 @@ +name: Windows AD Self DACL Assignment +id: 16132445-da9f-4d03-ad44-56d717dcd67d +version: 1 +date: '2023-12-18' +author: Dean Luxton +status: production +type: TTP +data_source: +- Windows Security 5136 +description: Detect when a user creates a new DACL in AD for their own AD object. +search: >- + `wineventlog_security` EventCode=5136 + | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId + | rex field=old_value max_match=10000 "\((?P.*?)\)" + | rex field=new_value max_match=10000 "\((?P.*?)\)" + | mvexpand new_ace + | where NOT new_ace IN (old_values) + | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" + | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" + | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" + | lookup ace_type_lookup.csv ace_type_string as aceType OUTPUT ace_type_value as aceType + | lookup ace_flag_lookup.csv flag_string as aceFlags OUTPUT flag_value as ace_flag_value + | lookup ace_access_rights_lookup.csv access_rights_string as AccessRights OUTPUT access_rights_value + | lookup msad_guid_lookup.csv guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + ``` Optional SID resolution lookups + | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user + | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` + | lookup builtin_groups_lookup.csv builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | eval aceType=coalesce(ace_type_value,aceType), aceInheritance=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)), user=coalesce(user, group, builtin_group, aceSid) + | stats values(aceType) as aceType values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID + | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') + | rex field=user "\\\(?P.*?)$" + | where lower(src_user)=lower(nt_user) + | `windows_ad_self_dacl_assignment_filter` +how_to_implement: Ensure you are ingesting AD audit logs, see lantern doc in references for further details. This detection also leverages admon data. Ensure the admon macro is configured with the correct index. +known_false_positives: Unknown +references: +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +tags: + analytic_story: + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + confidence: 100 + impact: 80 + message: $src_user$ has created a DACL on $ObjectDN$ to grant themselves $aceControlAccessRights$ across $aceAccessRights$ + mitre_attack_id: + - T1484 + - T1098 + observable: + - name: src_user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 80 + required_fields: + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/aclmodification/windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/application/windows_ad_suspicious_attribute_modification.yml b/detections/application/windows_ad_suspicious_attribute_modification.yml new file mode 100644 index 0000000000..22098e9fd7 --- /dev/null +++ b/detections/application/windows_ad_suspicious_attribute_modification.yml @@ -0,0 +1,71 @@ +name: Windows AD Suspicious Attribute Modification +id: 5682052e-ce55-4f9f-8d28-59191420b7e0 +version: 1 +date: '2023-11-13' +author: Dean Luxton +status: production +type: TTP +data_source: +- Windows Security 5136 +description: Suspicious AD Attribute Modification +search: ' `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName IN ("msDS-AllowedToDelegateTo","msDS-AllowedToActOnBehalfOfOtherIdentity","msDS-KeyCredentialLink","scriptPath","msTSInitialProgram") OperationType=%%14674 + | table _time ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId DSName AttributeValue AttributeLDAPDisplayName + | rename SubjectLogonId as TargetLogonId, src_user as initiator, _time as eventTime + | appendpipe [| map search="search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$"] + | stats min(eventTime) as _time values(initiator) as src_user, values(DSName) as targetDomain, values(ObjectDN) as ObjectDN, values(ObjectClass) as ObjectClass, values(src_category) as src_category, values(src_ip) as src_ip values(LogonType) as LogonType values(AttributeValue) as AttributeValue values(AttributeLDAPDisplayName) as AttributeLDAPDisplayName by TargetLogonId + | rex field=ObjectDN "^CN=(?P.*?),[A-Z]{2}\=" + | eval dest=if(ObjectClass="computer",cn,null), user=if(ObjectClass="user",cn,null) + | fields - cn + | `windows_ad_suspicious_attribute_modification_filter`' +how_to_implement: This analytic leverages event code 5136, see documentation in references on how to enable logging. +known_false_positives: Unknown +references: +- https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +tags: + analytic_story: + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + confidence: 100 + impact: 100 + message: $src_user$ has added $user$ $aceAccessRights$ ACL rights to $ObjectClass$ $ObjectDN$ + mitre_attack_id: + - T1550 + - T1222 + - T1222.001 + observable: + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 100 + required_fields: + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/DCShadowPermissions/windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/application/windows_ad_suspicious_gpo_modification.yml b/detections/application/windows_ad_suspicious_gpo_modification.yml new file mode 100644 index 0000000000..5690ca4ba8 --- /dev/null +++ b/detections/application/windows_ad_suspicious_gpo_modification.yml @@ -0,0 +1,89 @@ +name: Windows AD Suspicious GPO Modification +id: 0a2afc18-a3b5-4452-b60a-2e774214f9bf +version: 1 +date: '2023-12-19' +author: Dean Luxton +status: production +type: TTP +data_source: +- Windows Security 5136 +- Windows Security 5145 +description: This analytic looks for a the creation of potentially harmful GPO which could lead to persistence or code execution on remote hosts. + Note, this analyic is looking for the absence of the corresponding 5136 events which is evidence of the GPOs being manually created (using a tool like PowerView) or potentially missing logs. +search: >- + `wineventlog_security` EventCode=5145 ShareName="\\\\*\\SYSVOL" RelativeTargetName IN (*\\ScheduledTasks.xml, *\\Groups.xml, *\\Registry.xml, *\\Services.xml, *\\Scripts\\*) NOT RelativeTargetName=*\\Scripts\\scripts.ini AccessMask=0x2 + | rex field=AccessList max_match=0 "(?P%%\d+)" + | table _time AccessMask src_ip src_user RelativeTargetName Logon_ID dvc + | rex field=RelativeTargetName "Policies\\\(?P{.*?})\\\(?P\w+?)\\\(\w+)\\\(?P\w+)\\\(?P\w+\.\w+)$" + | eval src=if(match(src_ip, "(?i)^fe80:"),dvc,src_ip), folder=case(RelativeTargetName like "%\\Scripts\\%","Scripts",folder="Groups","Local users and groups",1=1,folder) + | appendpipe + [| map search="search `wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=gPCMachineExtensionNames $gpo_guid$" + | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId + | rex field=old_value max_match=10000 "(?P\{.*?\})" + | rex field=new_value max_match=10000 "(?P\{.*?\})" + | rex field=ObjectDN max_match=10000 "CN=(?P\{.*?\})" + | mvexpand new_values + | where NOT new_values IN (old_values,"{00000000-0000-0000-0000-000000000000}",policy_guid) AND match(new_values, "^\{[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\}") + | lookup msad_guid_lookup.csv guid as new_values OUTPUTNEW displayName as policyType + | eval newPolicy=if(policyType like "%",policyType,new_values) + | stats values(OpCorrelationID) as OpCorrelationID values(newPolicy) as newPolicy by ObjectDN + | rex field=ObjectDN max_match=10000 "CN=(?P\{.*?\})" + | fields - ObjectDN] + | stats values(AccessMask) as AccessMask values(src) as src values(src_user) as src_user values(RelativeTargetName) as RelativeTargetName values(Logon_ID) as Logon_ID values(newPolicy) as newPolicy values(OpCorrelationID) as OpCorrelationID values(folder) as folder values(file) as file by gpo_guid + | mvexpand folder + | where NOT folder IN (newPolicy) + | `windows_ad_suspicious_gpo_modification_filter` +how_to_implement: Ingest EventCodes 5145 and 5136 from domain controllers. Additional SACLs required to capture EventCode 5136, see references for further information on how to configure this. + The Group Policy - Audit Detailed File Share will need to be enabled on the DCs to generate event code 5145, this event is very noisy on DCs, consider tuning out sysvol events which do not match access mask 0x2. +known_false_positives: When a GPO is manually created and there are no 5136 events. +references: +- https://github.com/PowerShellMafia/PowerSploit/blob/26a0757612e5654b4f792b012ab8f10f95d391c9/Recon/PowerView.ps1#L5907-L6122 +- https://github.com/X-C3LL/GPOwned +- https://rastamouse.me/ous-and-gpos-and-wmi-filters-oh-my/ +- https://wald0.com/?p=179 +- https://github.com/FSecureLABS/SharpGPOAbuse +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +tags: + analytic_story: + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + confidence: 100 + impact: 100 + message: $src_user$ has added new GPO Client Side Extensions $newPolicy$ to the policy $policyName$ + mitre_attack_id: + - T1484 + - T1484.001 + - T1222 + - T1222.001 + observable: + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 100 + required_fields: + - _time + - OperationType + - ObjectDN + - OpCorrelationID + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + - SubjectLogonId + - DSName + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_created/gpo_new_cse_windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml index b78653d7b2..3428db7c8d 100644 --- a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml +++ b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml @@ -1,8 +1,8 @@ name: Windows AD AdminSDHolder ACL Modified id: 00d877c3-7b7b-443d-9562-6b231e2abab9 -version: 2 -date: '2024-05-13' -author: Mauricio Velazco, Splunk +version: 3 +date: '2024-07-02' +author: Mauricio Velazco, Dean Luxton, Splunk type: TTP status: production data_source: @@ -15,10 +15,29 @@ description: The following analytic detects modifications to the Access Control can allow attackers to establish persistence and escalate privileges. If confirmed malicious, this could enable an attacker to control domain-level permissions, compromising the entire Active Directory environment. -search: ' `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=nTSecurityDescriptor - OperationType="%%14674" ObjectDN="CN=AdminSDHolder,CN=System*" | rex field=AttributeValue - max_match=10000 "A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;(?PS-1-[0-59]-\d{2}-\d{8,10}-\d{8,10}-\d{8,10}-[1-9]\d{3})\)" - | stats values(added_user_sid) by _time, Computer, SubjectUserName, ObjectDN | `windows_ad_adminsdholder_acl_modified_filter`' +search: >- + `wineventlog_security` EventCode=5136 ObjectClass=container ObjectDN="CN=AdminSDHolder,CN=System*" + | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId + | rex field=old_value max_match=10000 "\((?P.*?)\)" + | rex field=new_value max_match=10000 "\((?P.*?)\)" + | mvexpand new_ace + | where NOT new_ace IN (old_values) + | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" + | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" + | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" + | lookup msad_guid_lookup.csv guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup ace_access_rights_lookup.csv access_rights_string as AccessRights OUTPUT access_rights_value + | lookup ace_type_lookup.csv ace_type_string as aceType OUTPUT ace_type_value + | lookup ace_flag_lookup.csv flag_string as aceFlags OUTPUT flag_value as ace_flag_value + ``` Optional SID resolution lookups + | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user + | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group``` + | lookup builtin_groups_lookup.csv builtin_group_string as aceSid OUTPUTNEW builtin_group_name as builtin_group + | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) + | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user user + | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') + | search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) + | `windows_ad_adminsdholder_acl_modified_filter` how_to_implement: To successfully implement this search, you ned to be ingesting eventcode `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled. Additionally, a SACL needs to be created @@ -33,6 +52,7 @@ references: - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136 - https://learn.microsoft.com/en-us/windows/win32/secauthz/access-control-lists - https://medium.com/@cryps1s/detecting-windows-endpoint-compromise-with-sacls-cd748e10950 +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory tags: analytic_story: - Sneaky Active Directory Persistence Tricks diff --git a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml index 0be1143257..988329ebbf 100644 --- a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml +++ b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml @@ -1,11 +1,12 @@ name: Windows AD Domain Replication ACL Addition id: 8c372853-f459-4995-afdc-280c114d33ab -version: 2 -date: "2024-05-16" +version: 3 +date: "2024-07-02" author: Dean Luxton type: TTP -status: experimental -data_source: [] +status: production +data_source: +- Windows Security 5136 description: The following analytic detects the addition of permissions required for a DCSync attack, specifically DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, and DS-Replication-Get-Changes-In-Filtered-Set. It leverages EventCode 5136 from @@ -14,14 +15,29 @@ description: The following analytic detects the addition of permissions required attack, which can be used to replicate AD objects and exfiltrate sensitive data. If confirmed malicious, an attacker could gain extensive access to Active Directory, leading to severe data breaches and privilege escalation. -search: '`wineventlog_security` | rex field=AttributeValue max_match=10000 \"OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;(?PS-1-[0-59]-\d{2}-\d{8,10}-\d{8,10}-\d{8,10}-[1-9]\d{3})\)\"| - table _time dest src_user DSRGetChanges_user_sid DSRGetChangesAll_user_sid DSRGetChangesFiltered_user_sid| - mvexpand DSRGetChanges_user_sid| eval minDCSyncPermissions=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid,\"true\",\"false\"), - fullSet=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid AND DSRGetChanges_user_sid=DSRGetChangesFiltered_user_sid,\"true\",\"false\")| - where minDCSyncPermissions=\"true\" | lookup identity_lookup_expanded objectSid - as DSRGetChanges_user_sid OUTPUT sAMAccountName as user | rename DSRGetChanges_user_sid - as userSid | stats min(_time) as _time values(user) as user by dest src_user userSid - minDCSyncPermissions fullSet| `windows_ad_domain_replication_acl_addition_filter`' +search: >- + `wineventlog_security` EventCode=5136 ObjectClass=domainDNS + | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId + | rex field=old_value max_match=10000 "\((?P.*?)\)" + | rex field=new_value max_match=10000 "\((?P.*?)\)" + | mvexpand new_ace + | where NOT new_ace IN (old_values) + | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" + | search aceObjectGuid IN ("1131f6aa-9c07-11d1-f79f-00c04fc2dcd2","1131f6ad-9c07-11d1-f79f-00c04fc2dcd2","89e95b76-444d-4c62-991a-0facbeda640c") + | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" + | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" + | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup ace_access_rights_lookup.csv access_rights_string as AccessRights OUTPUT access_rights_value + | lookup ace_type_lookup.csv ace_type_string as aceType OUTPUT ace_type_value + | lookup ace_flag_lookup.csv flag_string as aceFlags OUTPUT flag_value as ace_flag_value + ``` Optional SID resolution lookups + | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user + | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` + | lookup builtin_groups_lookup.csv builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) + | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user user + | search (aceControlAccessRights="DS-Replication-Get-Changes" AND aceControlAccessRights="DS-Replication-Get-Changes-All") OR (aceControlAccessRights="1131f6aa-9c07-11d1-f79f-00c04fc2dcd2" AND aceControlAccessRights="1131f6ad-9c07-11d1-f79f-00c04fc2dcd2") + | `windows_ad_domain_replication_acl_addition_filter` how_to_implement: To successfully implement this search, you need to be ingesting the eventcode 5136. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled, alongside a SACL for `everybody` @@ -38,6 +54,7 @@ known_false_positives: When there is a change to nTSecurityDescriptor, Windows l references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb - https://github.com/SigmaHQ/sigma/blob/29a5c62784faf986dc03952ae3e90e3df3294284/rules/windows/builtin/security/win_security_account_backdoor_dcsync_rights.yml +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory tags: analytic_story: - Sneaky Active Directory Persistence Tricks @@ -56,17 +73,13 @@ tags: type: User role: - Victim - - name: dest - type: Hostname - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud required_fields: - _time - - dest + - OperationType - src_user - AttributeLDAPDisplayName - AttributeValue diff --git a/lookups/ace_access_rights_lookup.csv b/lookups/ace_access_rights_lookup.csv new file mode 100644 index 0000000000..734b14fee2 --- /dev/null +++ b/lookups/ace_access_rights_lookup.csv @@ -0,0 +1,14 @@ +access_rights_string,access_rights_value +RC,Read permissions +SD,Delete +WD,Modify permissions +WO,Modify owner +RP,Read all properties +WP,Write all properties +CC,Create all child objects +DC,Delete all child objects +LC,List contents +SW,All validated writes +LO,List objects +DT,Delete subtree +CR,All extended rights \ No newline at end of file diff --git a/lookups/ace_access_rights_lookup.yml b/lookups/ace_access_rights_lookup.yml new file mode 100644 index 0000000000..eb19f3befa --- /dev/null +++ b/lookups/ace_access_rights_lookup.yml @@ -0,0 +1,3 @@ +description: A lookup file that will contain translations for AD object ace access rights strings +filename: ace_access_rights_lookup.csv +name: ace_access_rights_lookup \ No newline at end of file diff --git a/lookups/ace_flag_lookup.csv b/lookups/ace_flag_lookup.csv new file mode 100644 index 0000000000..e2b08679eb --- /dev/null +++ b/lookups/ace_flag_lookup.csv @@ -0,0 +1,10 @@ +flag_string,flag_value +CI,Container inherit +OI,Object inherit +NP,No propagate +IO,Inherit only +ID,Inherited +SA,Audit success +FA,Audit failure +TP,Trust protected filter +CR,Critical \ No newline at end of file diff --git a/lookups/ace_flag_lookup.yml b/lookups/ace_flag_lookup.yml new file mode 100644 index 0000000000..90a0cacef1 --- /dev/null +++ b/lookups/ace_flag_lookup.yml @@ -0,0 +1,3 @@ +description: A lookup file that will contain translations for AD object ace flags strings +filename: ace_flag_lookup.csv +name: ace_flag_lookup.yml \ No newline at end of file diff --git a/lookups/ace_type_lookup.csv b/lookups/ace_type_lookup.csv new file mode 100644 index 0000000000..8323d6bd30 --- /dev/null +++ b/lookups/ace_type_lookup.csv @@ -0,0 +1,18 @@ +ace_type_string,ace_type_value +A,Access allowed +D,Access denied +OA,Object access allowed +OD,Object access denied +AU,Audit +AL,Alarm +OU,Object audit +OL,Object alarm +ML,Mandatory label +XA,Callback access allowed +XD,Callback access denied +RA,Resource attribute +SP,Scoped policy ID +XU,Callback audit +ZA,Callback object access allowed +TL,Process trust label +FL,Access filter \ No newline at end of file diff --git a/lookups/ace_type_lookup.yml b/lookups/ace_type_lookup.yml new file mode 100644 index 0000000000..ce9a833964 --- /dev/null +++ b/lookups/ace_type_lookup.yml @@ -0,0 +1,3 @@ +description: A lookup file that will contain translations for AD object ace type strings +filename: ace_type_lookup.csv +name: ace_type_lookup \ No newline at end of file diff --git a/lookups/builtin_groups_lookup.csv b/lookups/builtin_groups_lookup.csv new file mode 100644 index 0000000000..c190d96d88 --- /dev/null +++ b/lookups/builtin_groups_lookup.csv @@ -0,0 +1,39 @@ +builtin_group_string,builtin_group_name +AO,Account operators +RU,Alias to allow previous Windows 2000 +AN,Anonymous logon +AU,Authenticated users +BA,Built-in administrators +BG,Built-in guests +BO,Backup operators +BU,Built-in users +CA,Certificate server administrators +CG,Creator group +CO,Creator owner +DA,Domain administrators +DC,Domain computers +DD,Domain controllers +DG,Domain guests +DU,Domain users +EA,Enterprise administrators +ED,Enterprise domain controllers +WD,Everyone +PA,Group Policy administrators +IU,Interactively logged-on user +LA,Local administrator +LG,Local guest +LS,Local service account +SY,Local system +NU,Network sign-in user +NO,Network configuration operators +NS,Network service account +PO,Printer operators +PS,Personal self +PU,Power users +RS,RAS servers group +RD,Terminal server users +RE,Replicator +RC,Restricted code +SA,Schema administrators +SO,Server operators +SU,Service sign-in user \ No newline at end of file diff --git a/lookups/builtin_groups_lookup.yml b/lookups/builtin_groups_lookup.yml new file mode 100644 index 0000000000..cc4959d3c4 --- /dev/null +++ b/lookups/builtin_groups_lookup.yml @@ -0,0 +1,3 @@ +description: A lookup file that will contain translations for builtin AD group strings +filename: builtin_groups_lookup.csv +name: builtin_groups_lookup \ No newline at end of file diff --git a/lookups/msad_guid_lookup.csv b/lookups/msad_guid_lookup.csv new file mode 100644 index 0000000000..005354204b --- /dev/null +++ b/lookups/msad_guid_lookup.csv @@ -0,0 +1,1678 @@ +displayName,guid,type +"Domain Administer Server","ab721a52-1e2f-11d0-9819-00aa0040529b","Extended Rights" +"Change Password","ab721a53-1e2f-11d0-9819-00aa0040529b","Extended Rights" +"Reset Password","00299570-246d-11d0-a768-00aa006e0529","Extended Rights" +"Send As","ab721a54-1e2f-11d0-9819-00aa0040529b","Extended Rights" +"Receive As","ab721a56-1e2f-11d0-9819-00aa0040529b","Extended Rights" +"Send To","ab721a55-1e2f-11d0-9819-00aa0040529b","Extended Rights" +"Domain Password & Lockout Policies","c7407360-20bf-11d0-a768-00aa006e0529","Extended Rights" +"General Information","59ba2f42-79a2-11d0-9020-00c04fc2d3cf","Extended Rights" +"Account Restrictions","4c164200-20c0-11d0-a768-00aa006e0529","Extended Rights" +"Logon Information","5f202010-79a5-11d0-9020-00c04fc2d4cf","Extended Rights" +"Group Membership","bc0ac240-79a9-11d0-9020-00c04fc2d4cf","Extended Rights" +"Open Address List","a1990816-4298-11d1-ade2-00c04fd8d5cd","Extended Rights" +"Personal Information","77b5b886-944a-11d1-aebd-0000f80367c1","Extended Rights" +"Phone and Mail Options","e45795b2-9455-11d1-aebd-0000f80367c1","Extended Rights" +"Web Information","e45795b3-9455-11d1-aebd-0000f80367c1","Extended Rights" +"Replicating Directory Changes","1131f6aa-9c07-11d1-f79f-00c04fc2dcd2","Extended Rights" +"Replication Synchronization","1131f6ab-9c07-11d1-f79f-00c04fc2dcd2","Extended Rights" +"Manage Replication Topology","1131f6ac-9c07-11d1-f79f-00c04fc2dcd2","Extended Rights" +"Change Schema Master","e12b56b6-0a95-11d1-adbb-00c04fd8d5cd","Extended Rights" +"Change Rid Master","d58d5f36-0a98-11d1-adbb-00c04fd8d5cd","Extended Rights" +"Do Garbage Collection","fec364e0-0a98-11d1-adbb-00c04fd8d5cd","Extended Rights" +"Recalculate Hierarchy","0bc1554e-0a99-11d1-adbb-00c04fd8d5cd","Extended Rights" +"Allocate Rids","1abd7cf8-0a99-11d1-adbb-00c04fd8d5cd","Extended Rights" +"Change PDC","bae50096-4752-11d1-9052-00c04fc2d4cf","Extended Rights" +"Add GUID","440820ad-65b4-11d1-a3da-0000f875ae0d","Extended Rights" +"Change Domain Master","014bf69c-7b3b-11d1-85f6-08002be74fab","Extended Rights" +"Public Information","e48d0154-bcf8-11d1-8702-00c04fb96050","Extended Rights" +"Receive Dead Letter","4b6e08c0-df3c-11d1-9c86-006008764d0e","Extended Rights" +"Peek Dead Letter","4b6e08c1-df3c-11d1-9c86-006008764d0e","Extended Rights" +"Receive Computer Journal","4b6e08c2-df3c-11d1-9c86-006008764d0e","Extended Rights" +"Peek Computer Journal","4b6e08c3-df3c-11d1-9c86-006008764d0e","Extended Rights" +"Receive Message","06bd3200-df3e-11d1-9c86-006008764d0e","Extended Rights" +"Peek Message","06bd3201-df3e-11d1-9c86-006008764d0e","Extended Rights" +"Send Message","06bd3202-df3e-11d1-9c86-006008764d0e","Extended Rights" +"Receive Journal","06bd3203-df3e-11d1-9c86-006008764d0e","Extended Rights" +"Open Connector Queue","b4e60130-df3f-11d1-9c86-006008764d0e","Extended Rights" +"Apply Group Policy","edacfd8f-ffb3-11d1-b41d-00a0c968f939","Extended Rights" +"Remote Access Information","037088f8-0ae1-11d2-b422-00a0c968f939","Extended Rights" +"Add/Remove Replica In Domain","9923a32a-3607-11d2-b9be-0000f87a36b2","Extended Rights" +"Change Infrastructure Master","cc17b1fb-33d9-11d2-97d4-00c04fd8d5cd","Extended Rights" +"Update Schema Cache","be2bb760-7f46-11d2-b9ad-00c04f79f805","Extended Rights" +"Recalculate Security Inheritance","62dd28a8-7f46-11d2-b9ad-00c04f79f805","Extended Rights" +"Check Stale Phantoms","69ae6200-7f46-11d2-b9ad-00c04f79f805","Extended Rights" +Enroll,"0e10c968-78fb-11d2-90d4-00c04f79dc55","Extended Rights" +"Add/Remove self as member","bf9679c0-0de6-11d0-a285-00aa003049e2","Extended Rights" +"Validated write to DNS host name","72e39547-7b18-11d1-adef-00c04fd8d5cd","Extended Rights" +"Validated write to service principal name","f3a64788-5306-11d1-a9c5-0000f80367c1","Extended Rights" +"Generate Resultant Set of Policy (Planning)","b7b1b3dd-ab09-4242-9e30-9980e5d322f7","Extended Rights" +"Refresh Group Cache for Logons","9432c620-033c-4db7-8b58-14ef6d0bf477","Extended Rights" +"Enumerate Entire SAM Domain","91d67418-0135-4acc-8d79-c08e857cfbec","Extended Rights" +"Generate Resultant Set of Policy (Logging)","b7b1b3de-ab09-4242-9e30-9980e5d322f7","Extended Rights" +"Other Domain Parameters (for use by SAM)","b8119fd0-04f6-4762-ab7a-4986c76b3f9a","Extended Rights" +"DNS Host Name Attributes","72e39547-7b18-11d1-adef-00c04fd8d5cd","Extended Rights" +"Create Inbound Forest Trust","e2a36dc9-ae17-47c3-b58b-be34c55ba633","Extended Rights" +"Replicating Directory Changes All","1131f6ad-9c07-11d1-f79f-00c04fc2dcd2","Extended Rights" +"Migrate SID History","ba33815a-4f93-4c76-87f3-57574bff8109","Extended Rights" +"Reanimate Tombstones","45ec5156-db7e-47bb-b53f-dbeb2d03c40f","Extended Rights" +"Allowed to Authenticate","68b1d179-0d15-4d4f-ab71-46152e79a7bc","Extended Rights" +"Execute Forest Update Script","2f16c4a5-b98e-432c-952a-cb388ba33f2e","Extended Rights" +"Monitor Active Directory Replication","f98340fb-7c5b-4cdb-a00b-2ebdfa115a96","Extended Rights" +"Update Password Not Required Bit","280f369c-67c7-438e-ae98-1d46f3c6f541","Extended Rights" +"Unexpire Password","ccc2dc7d-a6ad-4a7a-8846-c04e3cc53501","Extended Rights" +"Enable Per User Reversibly Encrypted Password","05c74c5e-4deb-43b4-bd9f-86664c2a7fd5","Extended Rights" +"Query Self Quota","4ecc03fe-ffc0-4947-b630-eb672a8a9dbc","Extended Rights" +"Private Information","91e647de-d96f-4b70-9557-d63ff4f3ccd8","Extended Rights" +"Read Only Replication Secret Synchronization","1131f6ae-9c07-11d1-f79f-00c04fc2dcd2","Extended Rights" +"MS-TS-GatewayAccess","ffa6f046-ca4b-4feb-b40d-04dfee722543","Extended Rights" +"Terminal Server License Server","5805bc62-bdc9-4428-a5e2-856a0f4c185e","Extended Rights" +"Reload SSL/TLS Certificate","1a60ea8d-58a6-4b20-bcdc-fb71eb8a9ff8","Extended Rights" +"Replicating Directory Changes In Filtered Set","89e95b76-444d-4c62-991a-0facbeda640c","Extended Rights" +"Run Protect Admin Groups Task","7726b9d5-a4b4-4288-a6b2-dce952e80a7f","Extended Rights" +"Manage Optional Features for Active Directory","7c0e2a7c-a419-48e4-a995-10180aad54dd","Extended Rights" +"Allow a DC to create a clone of itself","3e0f7e18-2c7a-4c10-ba82-4d926db99a3e","Extended Rights" +"Validated write to MS DS behavior version","d31a8757-2447-4545-8081-3bb610cacbf2","Extended Rights" +"Validated write to MS DS Additional DNS Host Name","80863791-dbe9-4eb8-837e-7f0ab55d9ac7","Extended Rights" +AutoEnrollment,"a05b8cc2-17bc-4802-a710-e7c15ab866a2","Extended Rights" +"Set Owner of an object during creation.","4125c71f-7fac-4ff0-bcb7-f09a41325286","Extended Rights" +"Bypass the quota restrictions during creation.","88a9933e-e5c8-4f2a-9dd7-2527416b8092","Extended Rights" +"Read secret attributes of objects in a Partition.","084c93a2-620d-4879-a836-f0ae47de0e89","Extended Rights" +"Write secret attributes of objects in a Partition.","94825a8d-b171-4116-8146-1e34d8f54401","Extended Rights" +"Validated write to computer attributes.","9b026da6-0d3c-465c-8bee-5199d7165cba","Extended Rights" +accountExpires,"bf967915-0de6-11d0-a285-00aa003049e2","AD Attribute" +accountNameHistory,"031952ec-3b72-11d2-90cc-00c04fd91ab1","AD Attribute" +aCSAggregateTokenRatePerUser,"7f56127d-5301-11d1-a9c5-0000f80367c1","AD Attribute" +aCSAllocableRSVPBandwidth,"7f561283-5301-11d1-a9c5-0000f80367c1","AD Attribute" +aCSCacheTimeout,"1cb355a1-56d0-11d1-a9c6-0000f80367c1","AD Attribute" +aCSDirection,"7f56127a-5301-11d1-a9c5-0000f80367c1","AD Attribute" +aCSDSBMDeadTime,"1cb355a0-56d0-11d1-a9c6-0000f80367c1","AD Attribute" +aCSDSBMPriority,"1cb3559e-56d0-11d1-a9c6-0000f80367c1","AD Attribute" +aCSDSBMRefresh,"1cb3559f-56d0-11d1-a9c6-0000f80367c1","AD Attribute" +aCSEnableACSService,"7f561287-5301-11d1-a9c5-0000f80367c1","AD Attribute" +aCSEnableRSVPAccounting,"f072230e-aef5-11d1-bdcf-0000f80367c1","AD Attribute" +aCSEnableRSVPMessageLogging,"7f561285-5301-11d1-a9c5-0000f80367c1","AD Attribute" +aCSEventLogLevel,"7f561286-5301-11d1-a9c5-0000f80367c1","AD Attribute" +aCSIdentityName,"dab029b6-ddf7-11d1-90a5-00c04fd91ab1","AD Attribute" +aCSMaxAggregatePeakRatePerUser,"f072230c-aef5-11d1-bdcf-0000f80367c1","AD Attribute" +aCSMaxDurationPerFlow,"7f56127e-5301-11d1-a9c5-0000f80367c1","AD Attribute" +aCSMaxNoOfAccountFiles,"f0722310-aef5-11d1-bdcf-0000f80367c1","AD Attribute" +aCSMaxNoOfLogFiles,"1cb3559c-56d0-11d1-a9c6-0000f80367c1","AD Attribute" +aCSMaxPeakBandwidth,"7f561284-5301-11d1-a9c5-0000f80367c1","AD Attribute" +aCSMaxPeakBandwidthPerFlow,"7f56127c-5301-11d1-a9c5-0000f80367c1","AD Attribute" +aCSMaxSizeOfRSVPAccountFile,"f0722311-aef5-11d1-bdcf-0000f80367c1","AD Attribute" +aCSMaxSizeOfRSVPLogFile,"1cb3559d-56d0-11d1-a9c6-0000f80367c1","AD Attribute" +aCSMaxTokenBucketPerFlow,"81f6e0df-3b90-11d2-90cc-00c04fd91ab1","AD Attribute" +aCSMaxTokenRatePerFlow,"7f56127b-5301-11d1-a9c5-0000f80367c1","AD Attribute" +aCSMaximumSDUSize,"87a2d8f9-3b90-11d2-90cc-00c04fd91ab1","AD Attribute" +aCSMinimumDelayVariation,"9c65329b-3b90-11d2-90cc-00c04fd91ab1","AD Attribute" +aCSMinimumLatency,"9517fefb-3b90-11d2-90cc-00c04fd91ab1","AD Attribute" +aCSMinimumPolicedSize,"8d0e7195-3b90-11d2-90cc-00c04fd91ab1","AD Attribute" +aCSNonReservedMaxSDUSize,"aec2cfe3-3b90-11d2-90cc-00c04fd91ab1","AD Attribute" +aCSNonReservedMinPolicedSize,"b6873917-3b90-11d2-90cc-00c04fd91ab1","AD Attribute" +aCSNonReservedPeakRate,"a331a73f-3b90-11d2-90cc-00c04fd91ab1","AD Attribute" +aCSNonReservedTokenSize,"a916d7c9-3b90-11d2-90cc-00c04fd91ab1","AD Attribute" +aCSNonReservedTxLimit,"1cb355a2-56d0-11d1-a9c6-0000f80367c1","AD Attribute" +aCSNonReservedTxSize,"f072230d-aef5-11d1-bdcf-0000f80367c1","AD Attribute" +aCSPermissionBits,"7f561282-5301-11d1-a9c5-0000f80367c1","AD Attribute" +aCSPolicyName,"1cb3559a-56d0-11d1-a9c6-0000f80367c1","AD Attribute" +aCSPriority,"7f561281-5301-11d1-a9c5-0000f80367c1","AD Attribute" +aCSRSVPAccountFilesLocation,"f072230f-aef5-11d1-bdcf-0000f80367c1","AD Attribute" +aCSRSVPLogFilesLocation,"1cb3559b-56d0-11d1-a9c6-0000f80367c1","AD Attribute" +aCSServiceType,"7f56127f-5301-11d1-a9c5-0000f80367c1","AD Attribute" +aCSTimeOfDay,"7f561279-5301-11d1-a9c5-0000f80367c1","AD Attribute" +aCSTotalNoOfFlows,"7f561280-5301-11d1-a9c5-0000f80367c1","AD Attribute" +aCSServerList,"7cbd59a5-3b90-11d2-90cc-00c04fd91ab1","AD Attribute" +notes,"6d05fb41-246b-11d0-a9c8-00aa006c33ed","AD Attribute" +additionalTrustedServiceNames,"032160be-9824-11d1-aec0-0000f80367c1","AD Attribute" +streetAddress,"f0f8ff84-1191-11d0-a060-00aa006c33ed","AD Attribute" +addressBookRoots,"f70b6e48-06f4-11d2-aa53-00c04fd7d83a","AD Attribute" +addressEntryDisplayTable,"5fd42461-1262-11d0-a060-00aa006c33ed","AD Attribute" +addressEntryDisplayTableMSDOS,"5fd42462-1262-11d0-a060-00aa006c33ed","AD Attribute" +homePostalAddress,"16775781-47f3-11d1-a9c3-0000f80367c1","AD Attribute" +addressSyntax,"5fd42463-1262-11d0-a060-00aa006c33ed","AD Attribute" +addressType,"5fd42464-1262-11d0-a060-00aa006c33ed","AD Attribute" +adminContextMenu,"553fd038-f32e-11d0-b0bc-00c04fd8dca6","AD Attribute" +adminCount,"bf967918-0de6-11d0-a285-00aa003049e2","AD Attribute" +adminDescription,"bf967919-0de6-11d0-a285-00aa003049e2","AD Attribute" +adminDisplayName,"bf96791a-0de6-11d0-a285-00aa003049e2","AD Attribute" +adminMultiselectPropertyPages,"18f9b67d-5ac6-4b3b-97db-d0a406afb7ba","AD Attribute" +adminPropertyPages,"52458038-ca6a-11d0-afff-0000f80367c1","AD Attribute" +allowedAttributes,"9a7ad940-ca53-11d1-bbd0-0080c76670c0","AD Attribute" +allowedAttributesEffective,"9a7ad941-ca53-11d1-bbd0-0080c76670c0","AD Attribute" +allowedChildClasses,"9a7ad942-ca53-11d1-bbd0-0080c76670c0","AD Attribute" +allowedChildClassesEffective,"9a7ad943-ca53-11d1-bbd0-0080c76670c0","AD Attribute" +altSecurityIdentities,"00fbf30c-91fe-11d1-aebc-0000f80367c1","AD Attribute" +aNR,"45b01500-c419-11d1-bbc9-0080c76670c0","AD Attribute" +appSchemaVersion,"96a7dd65-9118-11d1-aebc-0000f80367c1","AD Attribute" +applicationName,"dd712226-10e4-11d0-a05f-00aa006c33ed","AD Attribute" +appliesTo,"8297931d-86d3-11d0-afda-00c04fd930c9","AD Attribute" +assetNumber,"ba305f75-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +assistant,"0296c11c-40da-11d1-a9c0-0000f80367c1","AD Attribute" +assocNTAccount,"398f63c0-ca60-11d1-bbd1-0000f81f10c0","AD Attribute" +associatedDomain,"3320fc38-c379-4c17-a510-1bdf6133c5da","AD Attribute" +associatedName,"f7fbfc45-85ab-42a4-a435-780e62f7858b","AD Attribute" +attributeCertificateAttribute,"fa4693bb-7bc2-4cb9-81a8-c99c43b7905e","AD Attribute" +attributeDisplayNames,"cb843f80-48d9-11d1-a9c3-0000f80367c1","AD Attribute" +attributeID,"bf967922-0de6-11d0-a285-00aa003049e2","AD Attribute" +attributeSecurityGUID,"bf967924-0de6-11d0-a285-00aa003049e2","AD Attribute" +attributeSyntax,"bf967925-0de6-11d0-a285-00aa003049e2","AD Attribute" +attributeTypes,"9a7ad944-ca53-11d1-bbd0-0080c76670c0","AD Attribute" +audio,"d0e1d224-e1a0-42ce-a2da-793ba5244f35","AD Attribute" +auditingPolicy,"6da8a4fe-0e52-11d0-a286-00aa003049e2","AD Attribute" +authenticationOptions,"bf967928-0de6-11d0-a285-00aa003049e2","AD Attribute" +authorityRevocationList,"1677578d-47f3-11d1-a9c3-0000f80367c1","AD Attribute" +auxiliaryClass,"bf96792c-0de6-11d0-a285-00aa003049e2","AD Attribute" +badPasswordTime,"bf96792d-0de6-11d0-a285-00aa003049e2","AD Attribute" +badPwdCount,"bf96792e-0de6-11d0-a285-00aa003049e2","AD Attribute" +birthLocation,"1f0075f9-7e40-11d0-afd6-00c04fd930c9","AD Attribute" +bridgeheadServerListBL,"d50c2cdb-8951-11d1-aebc-0000f80367c1","AD Attribute" +bridgeheadTransportList,"d50c2cda-8951-11d1-aebc-0000f80367c1","AD Attribute" +buildingName,"f87fa54b-b2c5-4fd7-88c0-daccb21d93c5","AD Attribute" +builtinCreationTime,"bf96792f-0de6-11d0-a285-00aa003049e2","AD Attribute" +builtinModifiedCount,"bf967930-0de6-11d0-a285-00aa003049e2","AD Attribute" +businessCategory,"bf967931-0de6-11d0-a285-00aa003049e2","AD Attribute" +bytesPerMinute,"ba305f76-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +cACertificate,"bf967932-0de6-11d0-a285-00aa003049e2","AD Attribute" +cACertificateDN,"963d2740-48be-11d1-a9c3-0000f80367c1","AD Attribute" +cAConnect,"963d2735-48be-11d1-a9c3-0000f80367c1","AD Attribute" +cAUsages,"963d2738-48be-11d1-a9c3-0000f80367c1","AD Attribute" +cAWEBURL,"963d2736-48be-11d1-a9c3-0000f80367c1","AD Attribute" +canUpgradeScript,"d9e18314-8939-11d1-aebc-0000f80367c1","AD Attribute" +canonicalName,"9a7ad945-ca53-11d1-bbd0-0080c76670c0","AD Attribute" +carLicense,"d4159c92-957d-4a87-8a67-8d2934e01649","AD Attribute" +catalogs,"7bfdcb81-4807-11d1-a9c3-0000f80367c1","AD Attribute" +categories,"7bfdcb7e-4807-11d1-a9c3-0000f80367c1","AD Attribute" +categoryId,"7d6c0e94-7e20-11d0-afd6-00c04fd930c9","AD Attribute" +certificateAuthorityObject,"963d2732-48be-11d1-a9c3-0000f80367c1","AD Attribute" +certificateRevocationList,"1677579f-47f3-11d1-a9c3-0000f80367c1","AD Attribute" +certificateTemplates,"2a39c5b1-8960-11d1-aebc-0000f80367c1","AD Attribute" +classDisplayName,"548e1c22-dea6-11d0-b010-0000f80367c1","AD Attribute" +codePage,"bf967938-0de6-11d0-a285-00aa003049e2","AD Attribute" +cOMClassID,"bf96793b-0de6-11d0-a285-00aa003049e2","AD Attribute" +cOMCLSID,"281416d9-1968-11d0-a28f-00aa003049e2","AD Attribute" +cOMInterfaceID,"bf96793c-0de6-11d0-a285-00aa003049e2","AD Attribute" +cOMOtherProgId,"281416dd-1968-11d0-a28f-00aa003049e2","AD Attribute" +cOMProgID,"bf96793d-0de6-11d0-a285-00aa003049e2","AD Attribute" +cOMTreatAsClassId,"281416db-1968-11d0-a28f-00aa003049e2","AD Attribute" +cOMTypelibId,"281416de-1968-11d0-a28f-00aa003049e2","AD Attribute" +cOMUniqueLIBID,"281416da-1968-11d0-a28f-00aa003049e2","AD Attribute" +info,"bf96793e-0de6-11d0-a285-00aa003049e2","AD Attribute" +cn,"bf96793f-0de6-11d0-a285-00aa003049e2","AD Attribute" +company,"f0f8ff88-1191-11d0-a060-00aa006c33ed","AD Attribute" +contentIndexingAllowed,"bf967943-0de6-11d0-a285-00aa003049e2","AD Attribute" +contextMenu,"4d8601ee-ac85-11d0-afe3-00c04fd930c9","AD Attribute" +controlAccessRights,"6da8a4fc-0e52-11d0-a286-00aa003049e2","AD Attribute" +cost,"bf967944-0de6-11d0-a285-00aa003049e2","AD Attribute" +countryCode,"5fd42471-1262-11d0-a060-00aa006c33ed","AD Attribute" +c,"bf967945-0de6-11d0-a285-00aa003049e2","AD Attribute" +createDialog,"2b09958a-8931-11d1-aebc-0000f80367c1","AD Attribute" +createTimeStamp,"2df90d73-009f-11d2-aa4c-00c04fd7d83a","AD Attribute" +createWizardExt,"2b09958b-8931-11d1-aebc-0000f80367c1","AD Attribute" +creationTime,"bf967946-0de6-11d0-a285-00aa003049e2","AD Attribute" +creationWizard,"4d8601ed-ac85-11d0-afe3-00c04fd930c9","AD Attribute" +creator,"7bfdcb85-4807-11d1-a9c3-0000f80367c1","AD Attribute" +cRLObject,"963d2737-48be-11d1-a9c3-0000f80367c1","AD Attribute" +cRLPartitionedRevocationList,"963d2731-48be-11d1-a9c3-0000f80367c1","AD Attribute" +crossCertificatePair,"167757b2-47f3-11d1-a9c3-0000f80367c1","AD Attribute" +currMachineId,"1f0075fe-7e40-11d0-afd6-00c04fd930c9","AD Attribute" +currentLocation,"1f0075fc-7e40-11d0-afd6-00c04fd930c9","AD Attribute" +currentParentCA,"963d273f-48be-11d1-a9c3-0000f80367c1","AD Attribute" +currentValue,"bf967947-0de6-11d0-a285-00aa003049e2","AD Attribute" +dBCSPwd,"bf96799c-0de6-11d0-a285-00aa003049e2","AD Attribute" +defaultClassStore,"bf967948-0de6-11d0-a285-00aa003049e2","AD Attribute" +defaultGroup,"720bc4e2-a54a-11d0-afdf-00c04fd930c9","AD Attribute" +defaultHidingValue,"b7b13116-b82e-11d0-afee-0000f80367c1","AD Attribute" +defaultLocalPolicyObject,"bf96799f-0de6-11d0-a285-00aa003049e2","AD Attribute" +defaultObjectCategory,"26d97367-6070-11d1-a9c6-0000f80367c1","AD Attribute" +defaultPriority,"281416c8-1968-11d0-a28f-00aa003049e2","AD Attribute" +defaultSecurityDescriptor,"807a6d30-1669-11d0-a064-00aa006c33ed","AD Attribute" +deltaRevocationList,"167757b5-47f3-11d1-a9c3-0000f80367c1","AD Attribute" +department,"bf96794f-0de6-11d0-a285-00aa003049e2","AD Attribute" +departmentNumber,"be9ef6ee-cbc7-4f22-b27b-96967e7ee585","AD Attribute" +description,"bf967950-0de6-11d0-a285-00aa003049e2","AD Attribute" +desktopProfile,"eea65906-8ac6-11d0-afda-00c04fd930c9","AD Attribute" +destinationIndicator,"bf967951-0de6-11d0-a285-00aa003049e2","AD Attribute" +dhcpClasses,"963d2750-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpFlags,"963d2741-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpIdentification,"963d2742-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpMask,"963d2747-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpMaxKey,"963d2754-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpObjDescription,"963d2744-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpObjName,"963d2743-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpOptions,"963d274f-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpProperties,"963d2753-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpRanges,"963d2748-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpReservations,"963d274a-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpServers,"963d2745-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpSites,"963d2749-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpState,"963d2752-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpSubnets,"963d2746-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpType,"963d273b-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpUniqueKey,"963d273a-48be-11d1-a9c3-0000f80367c1","AD Attribute" +dhcpUpdateTime,"963d2755-48be-11d1-a9c3-0000f80367c1","AD Attribute" +displayName,"bf967953-0de6-11d0-a285-00aa003049e2","AD Attribute" +displayNamePrintable,"bf967954-0de6-11d0-a285-00aa003049e2","AD Attribute" +dITContentRules,"9a7ad946-ca53-11d1-bbd0-0080c76670c0","AD Attribute" +division,"fe6136a0-2073-11d0-a9c2-00aa006c33ed","AD Attribute" +dMDLocation,"f0f8ff8b-1191-11d0-a060-00aa006c33ed","AD Attribute" +dmdName,"167757b9-47f3-11d1-a9c3-0000f80367c1","AD Attribute" +dNReferenceUpdate,"2df90d86-009f-11d2-aa4c-00c04fd7d83a","AD Attribute" +dnsAllowDynamic,"e0fa1e65-9b45-11d0-afdd-00c04fd930c9","AD Attribute" +dnsAllowXFR,"e0fa1e66-9b45-11d0-afdd-00c04fd930c9","AD Attribute" +dNSHostName,"72e39547-7b18-11d1-adef-00c04fd8d5cd","AD Attribute" +dnsNotifySecondaries,"e0fa1e68-9b45-11d0-afdd-00c04fd930c9","AD Attribute" +dNSProperty,"675a15fe-3b70-11d2-90cc-00c04fd91ab1","AD Attribute" +dnsRecord,"e0fa1e69-9b45-11d0-afdd-00c04fd930c9","AD Attribute" +dnsRoot,"bf967959-0de6-11d0-a285-00aa003049e2","AD Attribute" +dnsSecureSecondaries,"e0fa1e67-9b45-11d0-afdd-00c04fd930c9","AD Attribute" +dNSTombstoned,"d5eb2eb7-be4e-463b-a214-634a44d7392e","AD Attribute" +documentAuthor,"f18a8e19-af5f-4478-b096-6f35c27eb83f","AD Attribute" +documentIdentifier,"0b21ce82-ff63-46d9-90fb-c8b9f24e97b9","AD Attribute" +documentLocation,"b958b14e-ac6d-4ec4-8892-be70b69f7281","AD Attribute" +documentPublisher,"170f09d7-eb69-448a-9a30-f1afecfd32d7","AD Attribute" +documentTitle,"de265a9c-ff2c-47b9-91dc-6e6fe2c43062","AD Attribute" +documentVersion,"94b3a8a9-d613-4cec-9aad-5fbcc1046b43","AD Attribute" +domainCAs,"7bfdcb7a-4807-11d1-a9c3-0000f80367c1","AD Attribute" +dc,"19195a55-6da0-11d0-afd3-00c04fd930c9","AD Attribute" +domainCrossRef,"b000ea7b-a086-11d0-afdd-00c04fd930c9","AD Attribute" +domainID,"963d2734-48be-11d1-a9c3-0000f80367c1","AD Attribute" +domainIdentifier,"7f561278-5301-11d1-a9c5-0000f80367c1","AD Attribute" +domainPolicyObject,"bf96795d-0de6-11d0-a285-00aa003049e2","AD Attribute" +domainPolicyReference,"80a67e2a-9f22-11d0-afdd-00c04fd930c9","AD Attribute" +domainReplica,"bf96795e-0de6-11d0-a285-00aa003049e2","AD Attribute" +domainWidePolicy,"80a67e29-9f22-11d0-afdd-00c04fd930c9","AD Attribute" +drink,"1a1aa5b5-262e-4df6-af04-2cf6b0d80048","AD Attribute" +driverName,"281416c5-1968-11d0-a28f-00aa003049e2","AD Attribute" +driverVersion,"ba305f6e-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +dSCorePropagationData,"d167aa4b-8b08-11d2-9939-0000f87a57d4","AD Attribute" +dSHeuristics,"f0f8ff86-1191-11d0-a060-00aa006c33ed","AD Attribute" +dSUIAdminMaximum,"ee8d0ae0-6f91-11d2-9905-0000f87a57d4","AD Attribute" +dSUIAdminNotification,"f6ea0a94-6f91-11d2-9905-0000f87a57d4","AD Attribute" +dSUIShellMaximum,"fcca766a-6f91-11d2-9905-0000f87a57d4","AD Attribute" +dSASignature,"167757bc-47f3-11d1-a9c3-0000f80367c1","AD Attribute" +dynamicLDAPServer,"52458021-ca6a-11d0-afff-0000f80367c1","AD Attribute" +mail,"bf967961-0de6-11d0-a285-00aa003049e2","AD Attribute" +eFSPolicy,"8e4eb2ec-4712-11d0-a1a0-00c04fd930c9","AD Attribute" +employeeID,"bf967962-0de6-11d0-a285-00aa003049e2","AD Attribute" +employeeNumber,"a8df73ef-c5ea-11d1-bbcb-0080c76670c0","AD Attribute" +employeeType,"a8df73f0-c5ea-11d1-bbcb-0080c76670c0","AD Attribute" +Enabled,"a8df73f2-c5ea-11d1-bbcb-0080c76670c0","AD Attribute" +enabledConnection,"bf967963-0de6-11d0-a285-00aa003049e2","AD Attribute" +enrollmentProviders,"2a39c5b3-8960-11d1-aebc-0000f80367c1","AD Attribute" +entryTTL,"d213decc-d81a-4384-aac2-dcfcfd631cf8","AD Attribute" +extendedAttributeInfo,"9a7ad947-ca53-11d1-bbd0-0080c76670c0","AD Attribute" +extendedCharsAllowed,"bf967966-0de6-11d0-a285-00aa003049e2","AD Attribute" +extendedClassInfo,"9a7ad948-ca53-11d1-bbd0-0080c76670c0","AD Attribute" +extensionName,"bf967972-0de6-11d0-a285-00aa003049e2","AD Attribute" +extraColumns,"d24e2846-1dd9-4bcf-99d7-a6227cc86da7","AD Attribute" +facsimileTelephoneNumber,"bf967974-0de6-11d0-a285-00aa003049e2","AD Attribute" +fileExtPriority,"d9e18315-8939-11d1-aebc-0000f80367c1","AD Attribute" +flags,"bf967976-0de6-11d0-a285-00aa003049e2","AD Attribute" +flatName,"b7b13117-b82e-11d0-afee-0000f80367c1","AD Attribute" +forceLogoff,"bf967977-0de6-11d0-a285-00aa003049e2","AD Attribute" +foreignIdentifier,"3e97891e-8c01-11d0-afda-00c04fd930c9","AD Attribute" +friendlyNames,"7bfdcb88-4807-11d1-a9c3-0000f80367c1","AD Attribute" +fromEntry,"9a7ad949-ca53-11d1-bbd0-0080c76670c0","AD Attribute" +fromServer,"bf967979-0de6-11d0-a285-00aa003049e2","AD Attribute" +frsComputerReference,"2a132578-9373-11d1-aebc-0000f80367c1","AD Attribute" +frsComputerReferenceBL,"2a132579-9373-11d1-aebc-0000f80367c1","AD Attribute" +fRSControlDataCreation,"2a13257a-9373-11d1-aebc-0000f80367c1","AD Attribute" +fRSControlInboundBacklog,"2a13257b-9373-11d1-aebc-0000f80367c1","AD Attribute" +fRSControlOutboundBacklog,"2a13257c-9373-11d1-aebc-0000f80367c1","AD Attribute" +fRSDirectoryFilter,"1be8f171-a9ff-11d0-afe2-00c04fd930c9","AD Attribute" +fRSDSPoll,"1be8f177-a9ff-11d0-afe2-00c04fd930c9","AD Attribute" +fRSExtensions,"52458020-ca6a-11d0-afff-0000f80367c1","AD Attribute" +fRSFaultCondition,"1be8f178-a9ff-11d0-afe2-00c04fd930c9","AD Attribute" +fRSFileFilter,"1be8f170-a9ff-11d0-afe2-00c04fd930c9","AD Attribute" +fRSFlags,"2a13257d-9373-11d1-aebc-0000f80367c1","AD Attribute" +fRSLevelLimit,"5245801e-ca6a-11d0-afff-0000f80367c1","AD Attribute" +fRSMemberReference,"2a13257e-9373-11d1-aebc-0000f80367c1","AD Attribute" +fRSMemberReferenceBL,"2a13257f-9373-11d1-aebc-0000f80367c1","AD Attribute" +fRSPartnerAuthLevel,"2a132580-9373-11d1-aebc-0000f80367c1","AD Attribute" +fRSPrimaryMember,"2a132581-9373-11d1-aebc-0000f80367c1","AD Attribute" +fRSReplicaSetGUID,"5245801a-ca6a-11d0-afff-0000f80367c1","AD Attribute" +fRSReplicaSetType,"26d9736b-6070-11d1-a9c6-0000f80367c1","AD Attribute" +fRSRootPath,"1be8f174-a9ff-11d0-afe2-00c04fd930c9","AD Attribute" +fRSRootSecurity,"5245801f-ca6a-11d0-afff-0000f80367c1","AD Attribute" +fRSServiceCommand,"ddac0cee-af8f-11d0-afeb-00c04fd930c9","AD Attribute" +fRSServiceCommandStatus,"2a132582-9373-11d1-aebc-0000f80367c1","AD Attribute" +fRSStagingPath,"1be8f175-a9ff-11d0-afe2-00c04fd930c9","AD Attribute" +fRSTimeLastCommand,"2a132583-9373-11d1-aebc-0000f80367c1","AD Attribute" +fRSTimeLastConfigChange,"2a132584-9373-11d1-aebc-0000f80367c1","AD Attribute" +fRSUpdateTimeout,"1be8f172-a9ff-11d0-afe2-00c04fd930c9","AD Attribute" +fRSVersion,"2a132585-9373-11d1-aebc-0000f80367c1","AD Attribute" +fRSVersionGUID,"26d9736c-6070-11d1-a9c6-0000f80367c1","AD Attribute" +fRSWorkingPath,"1be8f173-a9ff-11d0-afe2-00c04fd930c9","AD Attribute" +fSMORoleOwner,"66171887-8f3c-11d0-afda-00c04fd930c9","AD Attribute" +garbageCollPeriod,"5fd424a1-1262-11d0-a060-00aa006c33ed","AD Attribute" +generatedConnection,"bf96797a-0de6-11d0-a285-00aa003049e2","AD Attribute" +generationQualifier,"16775804-47f3-11d1-a9c3-0000f80367c1","AD Attribute" +givenName,"f0f8ff8e-1191-11d0-a060-00aa006c33ed","AD Attribute" +globalAddressList,"f754c748-06f4-11d2-aa53-00c04fd7d83a","AD Attribute" +governsID,"bf96797d-0de6-11d0-a285-00aa003049e2","AD Attribute" +gPLink,"f30e3bbe-9ff0-11d1-b603-0000f80367c1","AD Attribute" +gPOptions,"f30e3bbf-9ff0-11d1-b603-0000f80367c1","AD Attribute" +gPCFileSysPath,"f30e3bc1-9ff0-11d1-b603-0000f80367c1","AD Attribute" +gPCFunctionalityVersion,"f30e3bc0-9ff0-11d1-b603-0000f80367c1","AD Attribute" +gPCMachineExtensionNames,"32ff8ecc-783f-11d2-9916-0000f87a57d4","AD Attribute" +gPCUserExtensionNames,"42a75fc6-783f-11d2-9916-0000f87a57d4","AD Attribute" +gPCWQLFilter,"7bd4c7a6-1add-4436-8c04-3999a880154c","AD Attribute" +groupAttributes,"bf96797e-0de6-11d0-a285-00aa003049e2","AD Attribute" +groupMembershipSAM,"bf967980-0de6-11d0-a285-00aa003049e2","AD Attribute" +groupPriority,"eea65905-8ac6-11d0-afda-00c04fd930c9","AD Attribute" +groupType,"9a9a021e-4a5b-11d1-a9c3-0000f80367c1","AD Attribute" +groupsToIgnore,"eea65904-8ac6-11d0-afda-00c04fd930c9","AD Attribute" +hasMasterNCs,"bf967982-0de6-11d0-a285-00aa003049e2","AD Attribute" +hasPartialReplicaNCs,"bf967981-0de6-11d0-a285-00aa003049e2","AD Attribute" +helpData16,"5fd424a7-1262-11d0-a060-00aa006c33ed","AD Attribute" +helpData32,"5fd424a8-1262-11d0-a060-00aa006c33ed","AD Attribute" +helpFileName,"5fd424a9-1262-11d0-a060-00aa006c33ed","AD Attribute" +hideFromAB,"ec05b750-a977-4efe-8e8d-ba6c1a6e33a8","AD Attribute" +homeDirectory,"bf967985-0de6-11d0-a285-00aa003049e2","AD Attribute" +homeDrive,"bf967986-0de6-11d0-a285-00aa003049e2","AD Attribute" +houseIdentifier,"a45398b7-c44a-4eb6-82d3-13c10946dbfe","AD Attribute" +host,"6043df71-fa48-46cf-ab7c-cbd54644b22d","AD Attribute" +iconPath,"f0f8ff83-1191-11d0-a060-00aa006c33ed","AD Attribute" +implementedCategories,"7d6c0e92-7e20-11d0-afd6-00c04fd930c9","AD Attribute" +indexedScopes,"7bfdcb87-4807-11d1-a9c3-0000f80367c1","AD Attribute" +initialAuthIncoming,"52458023-ca6a-11d0-afff-0000f80367c1","AD Attribute" +initialAuthOutgoing,"52458024-ca6a-11d0-afff-0000f80367c1","AD Attribute" +initials,"f0f8ff90-1191-11d0-a060-00aa006c33ed","AD Attribute" +installUiLevel,"96a7dd64-9118-11d1-aebc-0000f80367c1","AD Attribute" +instanceType,"bf96798c-0de6-11d0-a285-00aa003049e2","AD Attribute" +interSiteTopologyFailover,"b7c69e60-2cc7-11d2-854e-00a0c983f608","AD Attribute" +interSiteTopologyGenerator,"b7c69e5e-2cc7-11d2-854e-00a0c983f608","AD Attribute" +interSiteTopologyRenew,"b7c69e5f-2cc7-11d2-854e-00a0c983f608","AD Attribute" +internationalISDNNumber,"bf96798d-0de6-11d0-a285-00aa003049e2","AD Attribute" +invocationId,"bf96798e-0de6-11d0-a285-00aa003049e2","AD Attribute" +ipsecData,"b40ff81f-427a-11d1-a9c2-0000f80367c1","AD Attribute" +ipsecDataType,"b40ff81e-427a-11d1-a9c2-0000f80367c1","AD Attribute" +ipsecFilterReference,"b40ff823-427a-11d1-a9c2-0000f80367c1","AD Attribute" +ipsecID,"b40ff81d-427a-11d1-a9c2-0000f80367c1","AD Attribute" +ipsecISAKMPReference,"b40ff820-427a-11d1-a9c2-0000f80367c1","AD Attribute" +ipsecName,"b40ff81c-427a-11d1-a9c2-0000f80367c1","AD Attribute" +iPSECNegotiationPolicyAction,"07383075-91df-11d1-aebc-0000f80367c1","AD Attribute" +ipsecNegotiationPolicyReference,"b40ff822-427a-11d1-a9c2-0000f80367c1","AD Attribute" +iPSECNegotiationPolicyType,"07383074-91df-11d1-aebc-0000f80367c1","AD Attribute" +ipsecNFAReference,"b40ff821-427a-11d1-a9c2-0000f80367c1","AD Attribute" +ipsecOwnersReference,"b40ff824-427a-11d1-a9c2-0000f80367c1","AD Attribute" +ipsecPolicyReference,"b7b13118-b82e-11d0-afee-0000f80367c1","AD Attribute" +isCriticalSystemObject,"00fbf30d-91fe-11d1-aebc-0000f80367c1","AD Attribute" +isDefunct,"28630ebe-41d5-11d1-a9c1-0000f80367c1","AD Attribute" +isDeleted,"bf96798f-0de6-11d0-a285-00aa003049e2","AD Attribute" +isEphemeral,"f4c453f0-c5f1-11d1-bbcb-0080c76670c0","AD Attribute" +memberOf,"bf967991-0de6-11d0-a285-00aa003049e2","AD Attribute" +isMemberOfPartialAttributeSet,"19405b9d-3cfa-11d1-a9c0-0000f80367c1","AD Attribute" +isPrivilegeHolder,"19405b9c-3cfa-11d1-a9c0-0000f80367c1","AD Attribute" +isRecycled,"8fb59256-55f1-444b-aacb-f5b482fe3459","AD Attribute" +isSingleValued,"bf967992-0de6-11d0-a285-00aa003049e2","AD Attribute" +jpegPhoto,"bac80572-09c4-4fa9-9ae6-7628d7adbe0e","AD Attribute" +keywords,"bf967993-0de6-11d0-a285-00aa003049e2","AD Attribute" +knowledgeInformation,"1677581f-47f3-11d1-a9c3-0000f80367c1","AD Attribute" +labeledURI,"c569bb46-c680-44bc-a273-e6c227d71b45","AD Attribute" +lastBackupRestorationTime,"1fbb0be8-ba63-11d0-afef-0000f80367c1","AD Attribute" +lastContentIndexed,"bf967995-0de6-11d0-a285-00aa003049e2","AD Attribute" +lastKnownParent,"52ab8670-5709-11d1-a9c6-0000f80367c1","AD Attribute" +lastLogoff,"bf967996-0de6-11d0-a285-00aa003049e2","AD Attribute" +lastLogon,"bf967997-0de6-11d0-a285-00aa003049e2","AD Attribute" +lastLogonTimestamp,"c0e20a04-0e5a-4ff3-9482-5efeaecd7060","AD Attribute" +lastSetTime,"bf967998-0de6-11d0-a285-00aa003049e2","AD Attribute" +lastUpdateSequence,"7d6c0e9c-7e20-11d0-afd6-00c04fd930c9","AD Attribute" +lDAPAdminLimits,"7359a352-90f7-11d1-aebc-0000f80367c1","AD Attribute" +lDAPDisplayName,"bf96799a-0de6-11d0-a285-00aa003049e2","AD Attribute" +lDAPIPDenyList,"7359a353-90f7-11d1-aebc-0000f80367c1","AD Attribute" +legacyExchangeDN,"28630ebc-41d5-11d1-a9c1-0000f80367c1","AD Attribute" +linkID,"bf96799b-0de6-11d0-a285-00aa003049e2","AD Attribute" +linkTrackSecret,"2ae80fe2-47b4-11d0-a1a4-00c04fd930c9","AD Attribute" +lmPwdHistory,"bf96799d-0de6-11d0-a285-00aa003049e2","AD Attribute" +localPolicyFlags,"bf96799e-0de6-11d0-a285-00aa003049e2","AD Attribute" +localPolicyReference,"80a67e4d-9f22-11d0-afdd-00c04fd930c9","AD Attribute" +localeID,"bf9679a1-0de6-11d0-a285-00aa003049e2","AD Attribute" +l,"bf9679a2-0de6-11d0-a285-00aa003049e2","AD Attribute" +localizedDescription,"d9e18316-8939-11d1-aebc-0000f80367c1","AD Attribute" +localizationDisplayId,"a746f0d1-78d0-11d2-9916-0000f87a57d4","AD Attribute" +location,"09dcb79f-165f-11d0-a064-00aa006c33ed","AD Attribute" +lockOutObservationWindow,"bf9679a4-0de6-11d0-a285-00aa003049e2","AD Attribute" +lockoutDuration,"bf9679a5-0de6-11d0-a285-00aa003049e2","AD Attribute" +lockoutThreshold,"bf9679a6-0de6-11d0-a285-00aa003049e2","AD Attribute" +lockoutTime,"28630ebf-41d5-11d1-a9c1-0000f80367c1","AD Attribute" +thumbnailLogo,"bf9679a9-0de6-11d0-a285-00aa003049e2","AD Attribute" +logonCount,"bf9679aa-0de6-11d0-a285-00aa003049e2","AD Attribute" +logonHours,"bf9679ab-0de6-11d0-a285-00aa003049e2","AD Attribute" +logonWorkstation,"bf9679ac-0de6-11d0-a285-00aa003049e2","AD Attribute" +lSACreationTime,"bf9679ad-0de6-11d0-a285-00aa003049e2","AD Attribute" +lSAModifiedCount,"bf9679ae-0de6-11d0-a285-00aa003049e2","AD Attribute" +machineArchitecture,"bf9679af-0de6-11d0-a285-00aa003049e2","AD Attribute" +machinePasswordChangeInterval,"c9b6358e-bb38-11d0-afef-0000f80367c1","AD Attribute" +machineRole,"bf9679b2-0de6-11d0-a285-00aa003049e2","AD Attribute" +machineWidePolicy,"80a67e4f-9f22-11d0-afdd-00c04fd930c9","AD Attribute" +managedBy,"0296c120-40da-11d1-a9c0-0000f80367c1","AD Attribute" +managedObjects,"0296c124-40da-11d1-a9c0-0000f80367c1","AD Attribute" +manager,"bf9679b5-0de6-11d0-a285-00aa003049e2","AD Attribute" +mAPIID,"bf9679b7-0de6-11d0-a285-00aa003049e2","AD Attribute" +marshalledInterface,"bf9679b9-0de6-11d0-a285-00aa003049e2","AD Attribute" +masteredBy,"e48e64e0-12c9-11d3-9102-00c04fd91ab1","AD Attribute" +maxPwdAge,"bf9679bb-0de6-11d0-a285-00aa003049e2","AD Attribute" +maxRenewAge,"bf9679bc-0de6-11d0-a285-00aa003049e2","AD Attribute" +maxStorage,"bf9679bd-0de6-11d0-a285-00aa003049e2","AD Attribute" +maxTicketAge,"bf9679be-0de6-11d0-a285-00aa003049e2","AD Attribute" +mayContain,"bf9679bf-0de6-11d0-a285-00aa003049e2","AD Attribute" +meetingAdvertiseScope,"11b6cc8b-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingApplication,"11b6cc83-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingBandwidth,"11b6cc92-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingBlob,"11b6cc93-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingContactInfo,"11b6cc87-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingDescription,"11b6cc7e-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingEndTime,"11b6cc91-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingID,"11b6cc7c-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingIP,"11b6cc89-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingIsEncrypted,"11b6cc8e-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingKeyword,"11b6cc7f-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingLanguage,"11b6cc84-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingLocation,"11b6cc80-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingMaxParticipants,"11b6cc85-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingName,"11b6cc7d-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingOriginator,"11b6cc86-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingOwner,"11b6cc88-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingProtocol,"11b6cc81-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingRating,"11b6cc8d-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingRecurrence,"11b6cc8f-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingScope,"11b6cc8a-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingStartTime,"11b6cc90-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingType,"11b6cc82-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +meetingURL,"11b6cc8c-48c4-11d1-a9c3-0000f80367c1","AD Attribute" +member,"bf9679c0-0de6-11d0-a285-00aa003049e2","AD Attribute" +mhsORAddress,"0296c122-40da-11d1-a9c0-0000f80367c1","AD Attribute" +minPwdAge,"bf9679c2-0de6-11d0-a285-00aa003049e2","AD Attribute" +minPwdLength,"bf9679c3-0de6-11d0-a285-00aa003049e2","AD Attribute" +minTicketAge,"bf9679c4-0de6-11d0-a285-00aa003049e2","AD Attribute" +modifiedCount,"bf9679c5-0de6-11d0-a285-00aa003049e2","AD Attribute" +modifiedCountAtLastProm,"bf9679c6-0de6-11d0-a285-00aa003049e2","AD Attribute" +modifyTimeStamp,"9a7ad94a-ca53-11d1-bbd0-0080c76670c0","AD Attribute" +moniker,"bf9679c7-0de6-11d0-a285-00aa003049e2","AD Attribute" +monikerDisplayName,"bf9679c8-0de6-11d0-a285-00aa003049e2","AD Attribute" +moveTreeState,"1f2ac2c8-3b71-11d2-90cc-00c04fd91ab1","AD Attribute" +"msCOM-DefaultPartitionLink","998b10f7-aa1a-4364-b867-753d197fe670","AD Attribute" +"msCOM-ObjectId","430f678b-889f-41f2-9843-203b5a65572f","AD Attribute" +"msCOM-PartitionLink","09abac62-043f-4702-ac2b-6ca15eee5754","AD Attribute" +"msCOM-PartitionSetLink","67f121dc-7d02-4c7d-82f5-9ad4c950ac34","AD Attribute" +"msCOM-UserLink","9e6f3a4d-242c-4f37-b068-36b57f9fc852","AD Attribute" +"msCOM-UserPartitionSetLink","8e940c8a-e477-4367-b08d-ff2ff942dcd7","AD Attribute" +"msDRM-IdentityCertificate","e85e1204-3434-41ad-9b56-e2901228fff0","AD Attribute" +"msDS-AdditionalDnsHostName","80863791-dbe9-4eb8-837e-7f0ab55d9ac7","AD Attribute" +"msDS-AdditionalSamAccountName","975571df-a4d5-429a-9f59-cdc6581d91e6","AD Attribute" +"msDS-AllUsersTrustQuota","d3aa4a5c-4e03-4810-97aa-2b339e7a434b","AD Attribute" +"msDS-AllowedDNSSuffixes","8469441b-9ac4-4e45-8205-bd219dbf672d","AD Attribute" +"msDS-AllowedToDelegateTo","800d94d7-b7a1-42a1-b14d-7cae1423d07f","AD Attribute" +"msDS-Auxiliary-Classes","c4af1073-ee50-4be0-b8c0-89a41fe99abe","AD Attribute" +"msDS-Approx-Immed-Subordinates","e185d243-f6ce-4adb-b496-b0c005d7823c","AD Attribute" +"msDS-AuthenticatedAtDC","3e1ee99c-6604-4489-89d9-84798a89515a","AD Attribute" +"msDS-AuthenticatedToAccountlist","e8b2c971-a6df-47bc-8d6f-62770d527aa5","AD Attribute" +"msDS-AzApplicationData","503fc3e8-1cc6-461a-99a3-9eee04f402a7","AD Attribute" +"msDS-AzApplicationName","db5b0728-6208-4876-83b7-95d3e5695275","AD Attribute" +"msDS-AzApplicationVersion","7184a120-3ac4-47ae-848f-fe0ab20784d4","AD Attribute" +"msDS-AzBizRule","33d41ea8-c0c9-4c92-9494-f104878413fd","AD Attribute" +"msDS-AzBizRuleLanguage","52994b56-0e6c-4e07-aa5c-ef9d7f5a0e25","AD Attribute" +"msDS-AzClassId","013a7277-5c2d-49ef-a7de-b765b36a3f6f","AD Attribute" +"msDS-AzDomainTimeout","6448f56a-ca70-4e2e-b0af-d20e4ce653d0","AD Attribute" +"msDS-AzGenerateAudits","f90abab0-186c-4418-bb85-88447c87222a","AD Attribute" +"msDS-AzLastImportedBizRulePath","665acb5c-bb92-4dbc-8c59-b3638eab09b3","AD Attribute" +"msDS-AzLDAPQuery","5e53368b-fc94-45c8-9d7d-daf31ee7112d","AD Attribute" +"msDS-AzMajorVersion","cfb9adb7-c4b7-4059-9568-1ed9db6b7248","AD Attribute" +"msDS-AzMinorVersion","ee85ed93-b209-4788-8165-e702f51bfbf3","AD Attribute" +"msDS-AzOperationID","a5f3b553-5d76-4cbe-ba3f-4312152cab18","AD Attribute" +"msDS-AzScopeName","515a6b06-2617-4173-8099-d5605df043c6","AD Attribute" +"msDS-AzScriptEngineCacheMax","2629f66a-1f95-4bf3-a296-8e9d7b9e30c8","AD Attribute" +"msDS-AzScriptTimeout","87d0fb41-2c8b-41f6-b972-11fdfd50d6b0","AD Attribute" +"msDS-AzTaskIsRoleDefinition","7b078544-6c82-4fe9-872f-ff48ad2b2e26","AD Attribute" +"msDS-AzObjectGuid","8491e548-6c38-4365-a732-af041569b02c","AD Attribute" +"msDS-AzGenericData","b5f7e349-7a5b-407c-a334-a31c3f538b98","AD Attribute" +"msDS-Behavior-Version","d31a8757-2447-4545-8081-3bb610cacbf2","AD Attribute" +"msDS-ByteArray","f0d8972e-dd5b-40e5-a51d-044c7c17ece7","AD Attribute" +"msDS-Cached-Membership","69cab008-cdd4-4bc9-bab8-0ff37efe1b20","AD Attribute" +"msDS-Cached-Membership-Time-Stamp","3566bf1f-beee-4dcb-8abe-ef89fcfec6c1","AD Attribute" +"mS-DS-ConsistencyGuid","23773dc2-b63a-11d2-90e1-00c04fd91ab1","AD Attribute" +"mS-DS-ConsistencyChildCount","178b7bc2-b63a-11d2-90e1-00c04fd91ab1","AD Attribute" +"mS-DS-CreatorSID","c5e60132-1480-11d3-91c1-0000f87a57d4","AD Attribute" +"msDS-DateTime","234fcbd8-fb52-4908-a328-fd9f6e58e403","AD Attribute" +"msDS-DefaultQuota","6818f726-674b-441b-8a3a-f40596374cea","AD Attribute" +"msDS-DeletedObjectLifetime","a9b38cb6-189a-4def-8a70-0fcfa158148e","AD Attribute" +"msDS-DnsRootAlias","2143acca-eead-4d29-b591-85fa49ce9173","AD Attribute" +"msDS-EnabledFeature","5706aeaf-b940-4fb2-bcfc-5268683ad9fe","AD Attribute" +"msDS-EnabledFeatureBL","ce5b01bc-17c6-44b8-9dc1-a9668b00901b","AD Attribute" +"msDS-Entry-Time-To-Die","e1e9bad7-c6dd-4101-a843-794cec85b038","AD Attribute" +"msDS-ExecuteScriptPassword","9d054a5a-d187-46c1-9d85-42dfc44a56dd","AD Attribute" +"msDS-ExternalKey","b92fd528-38ac-40d4-818d-0433380837c1","AD Attribute" +"msDS-ExternalStore","604877cd-9cdb-47c7-b03d-3daadb044910","AD Attribute" +"msDS-OptionalFeatureGUID","9b88bda8-dd82-4998-a91d-5f2d2baf1927","AD Attribute" +"msDS-FilterContainers","fb00dcdf-ac37-483a-9c12-ac53a6603033","AD Attribute" +"msDS-HasInstantiatedNCs","11e9a5bc-4517-4049-af9c-51554fb0fc09","AD Attribute" +"msDS-HasDomainNCs","6f17e347-a842-4498-b8b3-15e007da4fed","AD Attribute" +"msDS-hasMasterNCs","ae2de0e2-59d7-4d47-8d47-ed4dfe4357ad","AD Attribute" +"msDS-HostServiceAccount","80641043-15a2-40e1-92a2-8ca866f70776","AD Attribute" +"msDS-HostServiceAccountBL","79abe4eb-88f3-48e7-89d6-f4bc7e98c331","AD Attribute" +"msDS-Integer","7bc64cea-c04e-4318-b102-3e0729371a65","AD Attribute" +"msDS-IntId","bc60096a-1b47-4b30-8877-602c93f56532","AD Attribute" +"msDS-IsPossibleValuesPresent","6fabdcda-8c53-204f-b1a4-9df0c67c1eb4","AD Attribute" +"msDS-isGC","1df5cf33-0fe5-499e-90e1-e94b42718a46","AD Attribute" +"msDS-isRODC","a8e8aa23-3e67-4af1-9d7a-2f1a1d633ac9","AD Attribute" +"msDS-LastKnownRDN","8ab15858-683e-466d-877f-d640e1f9a611","AD Attribute" +"msDS-KeyVersionNumber","c523e9c0-33b5-4ac8-8923-b57b927f42f6","AD Attribute" +"msDS-LogonTimeSyncInterval","ad7940f8-e43a-4a42-83bc-d688e59ea605","AD Attribute" +"msDs-masteredBy","60234769-4819-4615-a1b2-49d2f119acb5","AD Attribute" +"msDS-MaximumPasswordAge","fdd337f5-4999-4fce-b252-8ff9c9b43875","AD Attribute" +"msDS-MinimumPasswordAge","2a74f878-4d9c-49f9-97b3-6767d1cbd9a3","AD Attribute" +"msDS-MinimumPasswordLength","b21b3439-4c3a-441c-bb5f-08f20e9b315e","AD Attribute" +"msDS-OIDToGroupLink","f9c9a57c-3941-438d-bebf-0edaf2aca187","AD Attribute" +"msDS-OIDToGroupLinkBl","1a3d0d20-5844-4199-ad25-0f5039a76ada","AD Attribute" +"msDS-PasswordHistoryLength","fed81bb7-768c-4c2f-9641-2245de34794d","AD Attribute" +"msDS-PasswordComplexityEnabled","db68054b-c9c3-4bf0-b15b-0fb52552a610","AD Attribute" +"msDS-PasswordReversibleEncryptionEnabled","75ccdd8f-af6c-4487-bb4b-69e4d38a959c","AD Attribute" +"msDS-LocalEffectiveDeletionTime","94f2800c-531f-4aeb-975d-48ac39fd8ca4","AD Attribute" +"msDS-LocalEffectiveRecycleTime","4ad6016b-b0d2-4c9b-93b6-5964b17b968c","AD Attribute" +"msDS-LockoutObservationWindow","b05bda89-76af-468a-b892-1be55558ecc8","AD Attribute" +"msDS-LockoutDuration","421f889a-472e-4fe4-8eb9-e1d0bc6071b2","AD Attribute" +"msDS-LockoutThreshold","b8c8c35e-4a19-4a95-99d0-69fe4446286f","AD Attribute" +"msDS-PSOAppliesTo","64c80f48-cdd2-4881-a86d-4e97b6f561fc","AD Attribute" +"msDS-PSOApplied","5e6cf031-bda8-43c8-aca4-8fee4127005b","AD Attribute" +"msDS-RequiredDomainBehaviorVersion","eadd3dfe-ae0e-4cc2-b9b9-5fe5b6ed2dd2","AD Attribute" +"msDS-RequiredForestBehaviorVersion","4beca2e8-a653-41b2-8fee-721575474bec","AD Attribute" +"msDS-ResultantPSO","b77ea093-88d0-4780-9a98-911f8e8b1dca","AD Attribute" +"msDS-PasswordSettingsPrecedence","456374ac-1f0a-4617-93cf-bc55a7c9d341","AD Attribute" +"msDs-MaxValues","d1e169a4-ebe9-49bf-8fcb-8aef3874592d","AD Attribute" +"msDS-MembersForAzRole","cbf7e6cd-85a4-4314-8939-8bfe80597835","AD Attribute" +"msDS-MembersForAzRoleBL","ececcd20-a7e0-4688-9ccf-02ece5e287f5","AD Attribute" +"msDS-NcType","5a2eacd7-cc2b-48cf-9d9a-b6f1a0024de9","AD Attribute" +"msDS-NonMembers","cafcb1de-f23c-46b5-adf7-1e64957bd5db","AD Attribute" +"msDS-NonMembersBL","2a8c68fc-3a7a-4e87-8720-fe77c51cbe74","AD Attribute" +"msDS-PhoneticFirstName","4b1cba4e-302f-4134-ac7c-f01f6c797843","AD Attribute" +"msDS-PhoneticLastName","f217e4ec-0836-4b90-88af-2f5d4bbda2bc","AD Attribute" +"msDS-PhoneticDepartment","6cd53daf-003e-49e7-a702-6fa896e7a6ef","AD Attribute" +"msDS-PhoneticCompanyName","5bd5208d-e5f4-46ae-a514-543bc9c47659","AD Attribute" +"msDS-PhoneticDisplayName","e21a94e4-2d66-4ce5-b30d-0ef87a776ff0","AD Attribute" +"msDS-HABSeniorityIndex","def449f1-fd3b-4045-98cf-d9658da788b5","AD Attribute" +"msDS-PromotionSettings","c881b4e2-43c0-4ebe-b9bb-5250aa9b434c","AD Attribute" +"msDS-SiteName","98a7f36d-3595-448a-9e6f-6b8965baed9c","AD Attribute" +"msDS-SupportedEncryptionTypes","20119867-1d04-4ab7-9371-cfc3d5df0afd","AD Attribute" +"msDS-TrustForestTrustInfo","29cc866e-49d3-4969-942e-1dbc0925d183","AD Attribute" +"msDS-TombstoneQuotaFactor","461744d7-f3b6-45ba-8753-fb9552a5df32","AD Attribute" +"msDS-TopQuotaUsage","7b7cce4f-f1f5-4bb6-b7eb-23504af19e75","AD Attribute" +"ms-DS-MachineAccountQuota","d064fb68-1480-11d3-91c1-0000f87a57d4","AD Attribute" +"msDS-ObjectReference","638ec2e8-22e7-409c-85d2-11b21bee72de","AD Attribute" +"msDS-ObjectReferenceBL","2b702515-c1f7-4b3b-b148-c0e4c6ceecb4","AD Attribute" +"msDS-OperationsForAzRole","93f701be-fa4c-43b6-bc2f-4dbea718ffab","AD Attribute" +"msDS-OperationsForAzRoleBL","f85b6228-3734-4525-b6b7-3f3bb220902c","AD Attribute" +"msDS-OperationsForAzTask","1aacb436-2e9d-44a9-9298-ce4debeb6ebf","AD Attribute" +"msDS-OperationsForAzTaskBL","a637d211-5739-4ed1-89b2-88974548bc59","AD Attribute" +"msDS-Other-Settings","79d2f34c-9d7d-42bb-838f-866b3e4400e2","AD Attribute" +"msDS-PrincipalName","564e9325-d057-c143-9e3b-4f9e5ef46f93","AD Attribute" +"msDS-QuotaAmount","fbb9a00d-3a8c-4233-9cf9-7189264903a1","AD Attribute" +"msDS-QuotaEffective","6655b152-101c-48b4-b347-e1fcebc60157","AD Attribute" +"msDS-QuotaTrustee","16378906-4ea5-49be-a8d1-bfd41dff4f65","AD Attribute" +"msDS-QuotaUsed","b5a84308-615d-4bb7-b05f-2f1746aa439f","AD Attribute" +"msDS-NCReplCursors","8a167ce4-f9e8-47eb-8d78-f7fe80abb2cc","AD Attribute" +"msDS-NCReplInboundNeighbors","9edba85a-3e9e-431b-9b1a-a5b6e9eda796","AD Attribute" +"msDS-NCReplOutboundNeighbors","855f2ef5-a1c5-4cc4-ba6d-32522848b61f","AD Attribute" +"msDS-NC-Replica-Locations","97de9615-b537-46bc-ac0f-10720f3909f3","AD Attribute" +"msDS-NC-RO-Replica-Locations","3df793df-9858-4417-a701-735a1ecebf74","AD Attribute" +"msDS-NC-RO-Replica-Locations-BL","f547511c-5b2a-44cc-8358-992a88258164","AD Attribute" +"msDS-Non-Security-Group-Extra-Classes","2de144fc-1f52-486f-bdf4-16fcc3084e54","AD Attribute" +"msDS-PerUserTrustQuota","d161adf0-ca24-4993-a3aa-8b2c981302e8","AD Attribute" +"msDS-PerUserTrustTombstonesQuota","8b70a6c6-50f9-4fa3-a71e-1ce03040449b","AD Attribute" +"msDS-Preferred-GC-Site","d921b50a-0ab2-42cd-87f6-09cf83a91854","AD Attribute" +"msDS-ReplAttributeMetaData","d7c53242-724e-4c39-9d4c-2df8c9d66c7a","AD Attribute" +"msDS-ReplValueMetaData","2f5c8145-e1bd-410b-8957-8bfa81d5acfd","AD Attribute" +"mS-DS-ReplicatesNCReason","0ea12b84-08b3-11d3-91bc-0000f87a57d4","AD Attribute" +"msDS-Replication-Notify-First-DSA-Delay","85abd4f4-0a89-4e49-bdec-6f35bb2562ba","AD Attribute" +"msDS-Replication-Notify-Subsequent-DSA-Delay","d63db385-dd92-4b52-b1d8-0d3ecc0e86b6","AD Attribute" +"msDS-ReplicationEpoch","08e3aa79-eb1c-45b5-af7b-8f94246c8e41","AD Attribute" +"msDS-RetiredReplNCSignatures","d5b35506-19d6-4d26-9afb-11357ac99b5e","AD Attribute" +"msDs-Schema-Extensions","b39a61be-ed07-4cab-9a4a-4963ed0141e1","AD Attribute" +"msDS-SDReferenceDomain","4c51e316-f628-43a5-b06b-ffb695fcb4f3","AD Attribute" +"msDS-Security-Group-Extra-Classes","4f146ae8-a4fe-4801-a731-f51848a4f4e4","AD Attribute" +"msDS-Settings","0e1b47d7-40a3-4b48-8d1b-4cac0c1cdf21","AD Attribute" +"msDS-Site-Affinity","c17c5602-bcb7-46f0-9656-6370ca884b72","AD Attribute" +"msDS-SPNSuffixes","789ee1eb-8c8e-4e4c-8cec-79b31b7617b5","AD Attribute" +"msDS-TasksForAzRole","35319082-8c4a-4646-9386-c2949d49894d","AD Attribute" +"msDS-TasksForAzRoleBL","a0dcd536-5158-42fe-8c40-c00a7ad37959","AD Attribute" +"msDS-TasksForAzTask","b11c8ee2-5fcd-46a7-95f0-f38333f096cf","AD Attribute" +"msDS-TasksForAzTaskBL","df446e52-b5fa-4ca2-a42f-13f98a526c8f","AD Attribute" +"msDS-User-Account-Control-Computed","2cc4b836-b63f-4940-8d23-ea7acf06af56","AD Attribute" +"msDS-UserPasswordExpiryTimeComputed","add5cf10-7b09-4449-9ae6-2534148f8a72","AD Attribute" +"msDS-UpdateScript","146eb639-bb9f-4fc1-a825-e29e00c77920","AD Attribute" +"msDS-SourceObjectDN","773e93af-d3b4-48d4-b3f9-06457602d3d0","AD Attribute" +"msDS-KrbTgtLink","778ff5c9-6f4e-4b74-856a-d68383313910","AD Attribute" +"msDS-RevealedUsers","185c7821-3749-443a-bd6a-288899071adb","AD Attribute" +"msDS-hasFullReplicaNCs","1d3c2d18-42d0-4868-99fe-0eca1e6fa9f3","AD Attribute" +"msDS-NeverRevealGroup","15585999-fd49-4d66-b25d-eeb96aba8174","AD Attribute" +"msDS-RevealOnDemandGroup","303d9f4a-1dd6-4b38-8fc5-33afe8c988ad","AD Attribute" +"msDS-SecondaryKrbTgtNumber","aa156612-2396-467e-ad6a-28d23fdb1865","AD Attribute" +"msDS-RevealedDSAs","94f6f2ac-c76d-4b5e-b71f-f332c3e93c22","AD Attribute" +"msDS-KrbTgtLinkBl","5dd68c41-bfdf-438b-9b5d-39d9618bf260","AD Attribute" +"msDS-IsFullReplicaFor","c8bc72e0-a6b4-48f0-94a5-fd76a88c9987","AD Attribute" +"msDS-IsDomainFor","ff155a2a-44e5-4de0-8318-13a58988de4f","AD Attribute" +"msDS-IsPartialReplicaFor","37c94ff6-c6d4-498f-b2f9-c6f7f8647809","AD Attribute" +"msDS-IsUserCachableAtRodc","fe01245a-341f-4556-951f-48c033a89050","AD Attribute" +"msDS-RevealedList","cbdad11c-7fec-387b-6219-3a0627d9af81","AD Attribute" +"msDS-RevealedListBL","aa1c88fd-b0f6-429f-b2ca-9d902266e808","AD Attribute" +"msDS-LastSuccessfulInteractiveLogonTime","011929e6-8b5d-4258-b64a-00b0b4949747","AD Attribute" +"msDS-LastFailedInteractiveLogonTime","c7e7dafa-10c3-4b8b-9acd-54f11063742e","AD Attribute" +"msDS-FailedInteractiveLogonCount","dc3ca86f-70ad-4960-8425-a4d6313d93dd","AD Attribute" +"msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon","c5d234e5-644a-4403-a665-e26e0aef5e98","AD Attribute" +"msDS-USNLastSyncSuccess","31f7b8b6-c9f8-4f2d-a37b-58a823030331","AD Attribute" +"msDS-ValueTypeReference","78fc5d84-c1dc-3148-8984-58f792d41d3e","AD Attribute" +"msDS-ValueTypeReferenceBL","ab5543ad-23a1-3b45-b937-9b313d5474a8","AD Attribute" +"msDS-OptionalFeatureFlags","8a0560c1-97b9-4811-9db7-dc061598965b","AD Attribute" +"msds-tokenGroupNames","65650576-4699-4fc9-8d18-26e0cd0137a6","AD Attribute" +"msds-tokenGroupNamesGlobalAndUniversal","fa06d1f4-7922-4aad-b79c-b2201f54417c","AD Attribute" +"msds-tokenGroupNamesNoGCAcceptable","523fc6c8-9af4-4a02-9cd7-3dea129eeb27","AD Attribute" +msExchAssistantName,"a8df7394-c5ea-11d1-bbcb-0080c76670c0","AD Attribute" +msExchHouseIdentifier,"a8df7407-c5ea-11d1-bbcb-0080c76670c0","AD Attribute" +msExchLabeledURI,"16775820-47f3-11d1-a9c3-0000f80367c1","AD Attribute" +ownerBL,"bf9679f4-0de6-11d0-a285-00aa003049e2","AD Attribute" +"msFRS-Hub-Member","5643ff81-35b6-4ca9-9512-baf0bd0a2772","AD Attribute" +"msFRS-Topology-Pref","92aa27e0-5c50-402d-9ec1-ee847def9788","AD Attribute" +"msDFSR-Version","1a861408-38c3-49ea-ba75-85481a77c655","AD Attribute" +"msDFSR-Extension","78f011ec-a766-4b19-adcf-7b81ed781a4d","AD Attribute" +"msDFSR-RootPath","d7d5e8c1-e61f-464f-9fcf-20bbe0a2ec54","AD Attribute" +"msDFSR-RootSizeInMb","90b769ac-4413-43cf-ad7a-867142e740a3","AD Attribute" +"msDFSR-StagingPath","86b9a69e-f0a6-405d-99bb-77d977992c2a","AD Attribute" +"msDFSR-StagingSizeInMb","250a8f20-f6fc-4559-ae65-e4b24c67aebe","AD Attribute" +"msDFSR-ConflictPath","5cf0bcc8-60f7-4bff-bda6-aea0344eb151","AD Attribute" +"msDFSR-ConflictSizeInMb","9ad33fc9-aacf-4299-bb3e-d1fc6ea88e49","AD Attribute" +"msDFSR-Enabled","03726ae7-8e7d-4446-8aae-a91657c00993","AD Attribute" +"msDFSR-ReplicationGroupType","eeed0fc8-1001-45ed-80cc-bbf744930720","AD Attribute" +"msDFSR-TombstoneExpiryInMin","23e35d4c-e324-4861-a22f-e199140dae00","AD Attribute" +"msDFSR-FileFilter","d68270ac-a5dc-4841-a6ac-cd68be38c181","AD Attribute" +"msDFSR-DirectoryFilter","93c7b477-1f2e-4b40-b7bf-007e8d038ccf","AD Attribute" +"msDFSR-Schedule","4699f15f-a71f-48e2-9ff5-5897c0759205","AD Attribute" +"msDFSR-Keywords","048b4692-6227-4b67-a074-c4437083e14b","AD Attribute" +"msDFSR-Flags","fe515695-3f61-45c8-9bfa-19c148c57b09","AD Attribute" +"msDFSR-Options","d6d67084-c720-417d-8647-b696237a114c","AD Attribute" +"msDFSR-ContentSetGuid","1035a8e1-67a8-4c21-b7bb-031cdf99d7a0","AD Attribute" +"msDFSR-RdcEnabled","e3b44e05-f4a7-4078-a730-f48670a743f8","AD Attribute" +"msDFSR-RdcMinFileSizeInKb","f402a330-ace5-4dc1-8cc9-74d900bf8ae0","AD Attribute" +"msDFSR-DfsPath","2cc903e2-398c-443b-ac86-ff6b01eac7ba","AD Attribute" +"msDFSR-RootFence","51928e94-2cd8-4abe-b552-e50412444370","AD Attribute" +"msDFSR-ReplicationGroupGuid","2dad8796-7619-4ff8-966e-0a5cc67b287f","AD Attribute" +"msDFSR-DfsLinkTarget","f7b85ba9-3bf9-428f-aab4-2eee6d56f063","AD Attribute" +"msDFSR-MemberReference","261337aa-f1c3-44b2-bbea-c88d49e6f0c7","AD Attribute" +"msDFSR-ComputerReference","6c7b5785-3d21-41bf-8a8a-627941544d5a","AD Attribute" +"msDFSR-MemberReferenceBL","adde62c6-1880-41ed-bd3c-30b7d25e14f0","AD Attribute" +"msDFSR-ComputerReferenceBL","5eb526d7-d71b-44ae-8cc6-95460052e6ac","AD Attribute" +"msDFSR-Priority","eb20e7d6-32ad-42de-b141-16ad2631b01b","AD Attribute" +"msDFSR-DeletedPath","817cf0b8-db95-4914-b833-5a079ef65764","AD Attribute" +"msDFSR-DeletedSizeInMb","53ed9ad1-9975-41f4-83f5-0c061a12553a","AD Attribute" +"msDFSR-ReadOnly","5ac48021-e447-46e7-9d23-92c0c6a90dfb","AD Attribute" +"msDFSR-CachePolicy","db7a08e7-fc76-4569-a45f-f5ecb66a88b5","AD Attribute" +"msDFSR-MinDurationCacheInMin","4c5d607a-ce49-444a-9862-82a95f5d1fcc","AD Attribute" +"msDFSR-MaxAgeInCacheInMin","2ab0e48d-ac4e-4afc-83e5-a34240db6198","AD Attribute" +"msFVE-RecoveryPassword","43061ac1-c8ad-4ccc-b785-2bfac20fc60a","AD Attribute" +"msFVE-VolumeGuid","85e5a5cf-dcee-4075-9cfd-ac9db6a2f245","AD Attribute" +"msFVE-KeyPackage","1fd55ea8-88a7-47dc-8129-0daa97186a54","AD Attribute" +"msFVE-RecoveryGuid","f76909bc-e678-47a0-b0b3-f86a0044c06d","AD Attribute" +"msTPM-OwnerInformation","aa4e1a6d-550d-4e05-8c35-4afcb917a9fe","AD Attribute" +"msieee80211-Data","0e0d0938-2658-4580-a9f6-7a0ac7b566cb","AD Attribute" +"msieee80211-DataType","6558b180-35da-4efe-beed-521f8f48cafb","AD Attribute" +"msieee80211-ID","7f73ef75-14c9-4c23-81de-dd07a06f9e8b","AD Attribute" +"msIIS-FTPDir","8a5c99e9-2230-46eb-b8e8-e59d712eb9ee","AD Attribute" +"msIIS-FTPRoot","2a7827a4-1483-49a5-9d84-52e3812156b4","AD Attribute" +"msImaging-PSPIdentifier","51583ce9-94fa-4b12-b990-304c35b18595","AD Attribute" +"msImaging-PSPString","7b6760ae-d6ed-44a6-b6be-9de62c09ec67","AD Attribute" +"ms-net-ieee-80211-GP-PolicyGUID","35697062-1eaf-448b-ac1e-388e0be4fdee","AD Attribute" +"ms-net-ieee-80211-GP-PolicyData","9c1495a5-4d76-468e-991e-1433b0a67855","AD Attribute" +"ms-net-ieee-80211-GP-PolicyReserved","0f69c62e-088e-4ff5-a53a-e923cec07c0a","AD Attribute" +"ms-net-ieee-8023-GP-PolicyGUID","94a7b05a-b8b2-4f59-9c25-39e69baa1684","AD Attribute" +"ms-net-ieee-8023-GP-PolicyData","8398948b-7457-4d91-bd4d-8d7ed669c9f7","AD Attribute" +"ms-net-ieee-8023-GP-PolicyReserved","d3c527c7-2606-4deb-8cfd-18426feec8ce","AD Attribute" +"msPKI-Cert-Template-OID","3164c36a-ba26-468c-8bda-c1e5cc256728","AD Attribute" +"msPKI-Certificate-Application-Policy","dbd90548-aa37-4202-9966-8c537ba5ce32","AD Attribute" +"msPKI-Certificate-Name-Flag","ea1dddc4-60ff-416e-8cc0-17cee534bce7","AD Attribute" +"msPKI-Certificate-Policy","38942346-cc5b-424b-a7d8-6ffd12029c5f","AD Attribute" +"msPKI-CredentialRoamingTokens","b7ff5a38-0818-42b0-8110-d3d154c97f24","AD Attribute" +"msPKI-Enrollment-Flag","d15ef7d8-f226-46db-ae79-b34e560bd12c","AD Attribute" +"msPKI-Enrollment-Servers","f22bd38f-a1d0-4832-8b28-0331438886a6","AD Attribute" +"msPKI-Minimal-Key-Size","e96a63f5-417f-46d3-be52-db7703c503df","AD Attribute" +"msPKI-OID-Attribute","8c9e1288-5028-4f4f-a704-76d026f246ef","AD Attribute" +"msPKI-OID-CPS","5f49940e-a79f-4a51-bb6f-3d446a54dc6b","AD Attribute" +"msPKI-OIDLocalizedName","7d59a816-bb05-4a72-971f-5c1331f67559","AD Attribute" +"msPKI-OID-User-Notice","04c4da7a-e114-4e69-88de-e293f2d3b395","AD Attribute" +"msPKI-Private-Key-Flag","bab04ac2-0435-4709-9307-28380e7c7001","AD Attribute" +"msPKI-Site-Name","0cd8711f-0afc-4926-a4b1-09b08d3d436c","AD Attribute" +"msPKI-Supersede-Templates","9de8ae7d-7a5b-421d-b5e4-061f79dfd5d7","AD Attribute" +"msPKI-Template-Minor-Revision","13f5236c-1884-46b1-b5d0-484e38990d58","AD Attribute" +"msPKI-Template-Schema-Version","0c15e9f5-491d-4594-918f-32813a091da9","AD Attribute" +"msPKI-RA-Application-Policies","3c91fbbf-4773-4ccd-a87b-85d53e7bcf6a","AD Attribute" +"msPKI-RA-Policies","d546ae22-0951-4d47-817e-1c9f96faad46","AD Attribute" +"msPKI-RA-Signature","fe17e04b-937d-4f7e-8e0e-9292c8d5683e","AD Attribute" +msPKIRoamingTimeStamp,"6617e4ac-a2f1-43ab-b60c-11fbd1facf05","AD Attribute" +msPKIDPAPIMasterKeys,"b3f93023-9239-4f7c-b99c-6745d87adbc2","AD Attribute" +msPKIAccountCredentials,"b8dfa744-31dc-4ef1-ac7c-84baf7ef9da7","AD Attribute" +msRRASAttribute,"f39b98ad-938d-11d1-aebd-0000f80367c1","AD Attribute" +msRRASVendorAttributeEntry,"f39b98ac-938d-11d1-aebd-0000f80367c1","AD Attribute" +"msRADIUS-FramedInterfaceId","a6f24a23-d65c-4d65-a64f-35fb6873c2b9","AD Attribute" +"msRADIUS-SavedFramedInterfaceId","a4da7289-92a3-42e5-b6b6-dad16d280ac9","AD Attribute" +"msRADIUS-FramedIpv6Prefix","f63ed610-d67c-494d-87be-cd1e24359a38","AD Attribute" +"msRADIUS-SavedFramedIpv6Prefix","0965a062-b1e1-403b-b48d-5c0eb0e952cc","AD Attribute" +"msRADIUS-FramedIpv6Route","5a5aa804-3083-4863-94e5-018a79a22ec0","AD Attribute" +"msRADIUS-SavedFramedIpv6Route","9666bb5c-df9d-4d41-b437-2eec7e27c9b3","AD Attribute" +"mS-SQL-Name","3532dfd8-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-RegisteredOwner","48fd44ea-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Contact","4f6cbdd8-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Location","561c9644-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Memory","5b5d448c-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Build","603e94c4-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-ServiceAccount","64933a3e-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-CharacterSet","696177a6-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-SortOrder","6ddc42c0-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-UnicodeSortOrder","72dc918a-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Clustered","7778bd90-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-NamedPipe","7b91c840-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-MultiProtocol","8157fa38-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-SPX","86b08004-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-TCPIP","8ac263a6-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-AppleTalk","8fda89f4-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Vines","94c56394-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Status","9a7d4770-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-LastUpdatedDate","9fcc43d4-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-InformationURL","a42cd510-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-ConnectionURL","a92d23da-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-PublicationURL","ae0c11b8-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-GPSLatitude","b222ba0e-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-GPSLongitude","b7577c94-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-GPSHeight","bcdd4f0e-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Version","c07cc1d0-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Language","c57f72f4-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Description","8386603c-ccef-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Type","ca48eba8-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-InformationDirectory","d0aedb2e-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Database","d5a0dbdc-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-AllowAnonymousSubscription","db77be4a-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Alias","e0c6baae-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Size","e9098084-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-CreationDate","ede14754-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-LastBackupDate","f2b6abca-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-LastDiagnosticDate","f6d6dd88-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Applications","fbcda2ea-ccee-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Keywords","01e9a98a-ccef-11d2-9993-0000f87a57d4","AD Attribute" +"mS-SQL-Publisher","c1676858-d34b-11d2-999a-0000f87a57d4","AD Attribute" +"mS-SQL-AllowKnownPullSubscription","c3bb7054-d34b-11d2-999a-0000f87a57d4","AD Attribute" +"mS-SQL-AllowImmediateUpdatingSubscription","c4186b6e-d34b-11d2-999a-0000f87a57d4","AD Attribute" +"mS-SQL-AllowQueuedUpdatingSubscription","c458ca80-d34b-11d2-999a-0000f87a57d4","AD Attribute" +"mS-SQL-AllowSnapshotFilesFTPDownloading","c49b8be8-d34b-11d2-999a-0000f87a57d4","AD Attribute" +"mS-SQL-ThirdParty","c4e311fc-d34b-11d2-999a-0000f87a57d4","AD Attribute" +"msTAPI-ConferenceBlob","4cc4601e-7201-4141-abc8-3e529ae88863","AD Attribute" +"msTAPI-IpAddress","efd7d7f7-178e-4767-87fa-f8a16b840544","AD Attribute" +"msTAPI-ProtocolId","89c1ebcf-7a5f-41fd-99ca-c900b32299ab","AD Attribute" +"msTAPI-uid","70a4e7ea-b3b9-4643-8918-e6dd2471bfd4","AD Attribute" +"msWMI-Author","6366c0c1-6972-4e66-b3a5-1d52ad0c0547","AD Attribute" +"msWMI-ChangeDate","f9cdf7a0-ec44-4937-a79b-cd91522b3aa8","AD Attribute" +"msWMI-Class","90c1925f-4a24-4b07-b202-be32eb3c8b74","AD Attribute" +"msWMI-ClassDefinition","2b9c0ebc-c272-45cb-99d2-4d0e691632e0","AD Attribute" +"msWMI-CreationDate","748b0a2e-3351-4b3f-b171-2f17414ea779","AD Attribute" +"msWMI-Genus","50c8673a-8f56-4614-9308-9e1340fb9af3","AD Attribute" +"msWMI-ID","9339a803-94b8-47f7-9123-a853b9ff7e45","AD Attribute" +"msWMI-IntDefault","1b0c07f8-76dd-4060-a1e1-70084619dc90","AD Attribute" +"msWMI-intFlags1","18e006b9-6445-48e3-9dcf-b5ecfbc4df8e","AD Attribute" +"msWMI-intFlags2","075a42c9-c55a-45b1-ac93-eb086b31f610","AD Attribute" +"msWMI-intFlags3","f29fa736-de09-4be4-b23a-e734c124bacc","AD Attribute" +"msWMI-intFlags4","bd74a7ac-c493-4c9c-bdfa-5c7b119ca6b2","AD Attribute" +"msWMI-IntMax","fb920c2c-f294-4426-8ac1-d24b42aa2bce","AD Attribute" +"msWMI-IntMin","68c2e3ba-9837-4c70-98e0-f0c33695d023","AD Attribute" +"msWMI-IntValidValues","6af565f6-a749-4b72-9634-3c5d47e6b4e0","AD Attribute" +"msWMI-Int8Default","f4d8085a-8c5b-4785-959b-dc585566e445","AD Attribute" +"msWMI-Int8Max","e3d8b547-003d-4946-a32b-dc7cedc96b74","AD Attribute" +"msWMI-Int8Min","ed1489d1-54cc-4066-b368-a00daa2664f1","AD Attribute" +"msWMI-Int8ValidValues","103519a9-c002-441b-981a-b0b3e012c803","AD Attribute" +"msWMI-Mof","6736809f-2064-443e-a145-81262b1f1366","AD Attribute" +"msWMI-Name","c6c8ace5-7e81-42af-ad72-77412c5941c4","AD Attribute" +"msWMI-NormalizedClass","eaba628f-eb8e-4fe9-83fc-693be695559b","AD Attribute" +"msWMI-Parm1","27e81485-b1b0-4a8b-bedd-ce19a837e26e","AD Attribute" +"msWMI-Parm2","0003508e-9c42-4a76-a8f4-38bf64bab0de","AD Attribute" +"msWMI-Parm3","45958fb6-52bd-48ce-9f9f-c2712d9f2bfc","AD Attribute" +"msWMI-Parm4","3800d5a3-f1ce-4b82-a59a-1528ea795f59","AD Attribute" +"msWMI-PropertyName","ab920883-e7f8-4d72-b4a0-c0449897509d","AD Attribute" +"msWMI-Query","65fff93e-35e3-45a3-85ae-876c6718297f","AD Attribute" +"msWMI-QueryLanguage","7d3cfa98-c17b-4254-8bd7-4de9b932a345","AD Attribute" +"msWMI-ScopeGuid","87b78d51-405f-4b7f-80ed-2bd28786f48d","AD Attribute" +"msWMI-SourceOrganization","34f7ed6c-615d-418d-aa00-549a7d7be03e","AD Attribute" +"msWMI-StringDefault","152e42b6-37c5-4f55-ab48-1606384a9aea","AD Attribute" +"msWMI-StringValidValues","37609d31-a2bf-4b58-8f53-2b64e57a076d","AD Attribute" +"msWMI-TargetClass","95b6d8d6-c9e8-4661-a2bc-6a5cabc04c62","AD Attribute" +"msWMI-TargetNameSpace","1c4ab61f-3420-44e5-849d-8b5dbf60feb7","AD Attribute" +"msWMI-TargetObject","c44f67a5-7de5-4a1f-92d9-662b57364b77","AD Attribute" +"msWMI-TargetPath","5006a79a-6bfe-4561-9f52-13cf4dd3e560","AD Attribute" +"msWMI-TargetType","ca2a281e-262b-4ff7-b419-bc123352a4e9","AD Attribute" +mscopeId,"963d2751-48be-11d1-a9c3-0000f80367c1","AD Attribute" +msiFileList,"7bfdcb7d-4807-11d1-a9c3-0000f80367c1","AD Attribute" +msiScript,"d9e18313-8939-11d1-aebc-0000f80367c1","AD Attribute" +msiScriptName,"96a7dd62-9118-11d1-aebc-0000f80367c1","AD Attribute" +msiScriptPath,"bf967937-0de6-11d0-a285-00aa003049e2","AD Attribute" +msiScriptSize,"96a7dd63-9118-11d1-aebc-0000f80367c1","AD Attribute" +mSMQAuthenticate,"9a0dc326-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQBasePriority,"9a0dc323-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQComputerType,"9a0dc32e-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQComputerTypeEx,"18120de8-f4c4-4341-bd95-32eb5bcf7c80","AD Attribute" +mSMQCost,"9a0dc33a-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQCSPName,"9a0dc334-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQDependentClientService,"2df90d83-009f-11d2-aa4c-00c04fd7d83a","AD Attribute" +mSMQDependentClientServices,"2df90d76-009f-11d2-aa4c-00c04fd7d83a","AD Attribute" +mSMQDigests,"9a0dc33c-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQDigestsMig,"0f71d8e0-da3b-11d1-90a5-00c04fd91ab1","AD Attribute" +mSMQDsService,"2df90d82-009f-11d2-aa4c-00c04fd7d83a","AD Attribute" +mSMQDsServices,"2df90d78-009f-11d2-aa4c-00c04fd7d83a","AD Attribute" +mSMQEncryptKey,"9a0dc331-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQForeign,"9a0dc32f-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQInRoutingServers,"9a0dc32c-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQInterval1,"8ea825aa-3b7b-11d2-90cc-00c04fd91ab1","AD Attribute" +mSMQInterval2,"99b88f52-3b7b-11d2-90cc-00c04fd91ab1","AD Attribute" +mSMQJournal,"9a0dc321-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQJournalQuota,"9a0dc324-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQLabel,"9a0dc325-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQLabelEx,"4580ad25-d407-48d2-ad24-43e6e56793d7","AD Attribute" +mSMQLongLived,"9a0dc335-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQMigrated,"9a0dc33f-c100-11d1-bbc5-0080c76670c0","AD Attribute" +"MSMQ-MulticastAddress","1d2f4412-f10d-4337-9b48-6e5b125cd265","AD Attribute" +mSMQNameStyle,"9a0dc333-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQNt4Flags,"eb38a158-d57f-11d1-90a2-00c04fd91ab1","AD Attribute" +mSMQNt4Stub,"6f914be6-d57e-11d1-90a2-00c04fd91ab1","AD Attribute" +mSMQOSType,"9a0dc330-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQOutRoutingServers,"9a0dc32b-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQOwnerID,"9a0dc328-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQPrevSiteGates,"2df90d75-009f-11d2-aa4c-00c04fd7d83a","AD Attribute" +mSMQPrivacyLevel,"9a0dc327-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQQMID,"9a0dc33e-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQQueueJournalQuota,"8e441266-d57f-11d1-90a2-00c04fd91ab1","AD Attribute" +mSMQQueueNameExt,"2df90d87-009f-11d2-aa4c-00c04fd7d83a","AD Attribute" +mSMQQueueQuota,"3f6b8e12-d57f-11d1-90a2-00c04fd91ab1","AD Attribute" +mSMQQueueType,"9a0dc320-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQQuota,"9a0dc322-c100-11d1-bbc5-0080c76670c0","AD Attribute" +"msMQ-Recipient-FormatName","3bfe6748-b544-485a-b067-1b310c4334bf","AD Attribute" +mSMQRoutingService,"2df90d81-009f-11d2-aa4c-00c04fd7d83a","AD Attribute" +mSMQRoutingServices,"2df90d77-009f-11d2-aa4c-00c04fd7d83a","AD Attribute" +"MSMQ-SecuredSource","8bf0221b-7a06-4d63-91f0-1499941813d3","AD Attribute" +mSMQServiceType,"9a0dc32d-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQServices,"9a0dc33d-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQSignCertificates,"9a0dc33b-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQSignCertificatesMig,"3881b8ea-da3b-11d1-90a5-00c04fd91ab1","AD Attribute" +mSMQSignKey,"9a0dc332-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQSite1,"9a0dc337-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQSite2,"9a0dc338-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQSiteForeign,"fd129d8a-d57e-11d1-90a2-00c04fd91ab1","AD Attribute" +mSMQSiteGates,"9a0dc339-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQSiteGatesMig,"e2704852-3b7b-11d2-90cc-00c04fd91ab1","AD Attribute" +mSMQSiteID,"9a0dc340-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQSiteName,"ffadb4b2-de39-11d1-90a5-00c04fd91ab1","AD Attribute" +mSMQSiteNameEx,"422144fa-c17f-4649-94d6-9731ed2784ed","AD Attribute" +mSMQSites,"9a0dc32a-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQTransactional,"9a0dc329-c100-11d1-bbc5-0080c76670c0","AD Attribute" +mSMQUserSid,"c58aae32-56f9-11d2-90d0-00c04fd91ab1","AD Attribute" +mSMQVersion,"9a0dc336-c100-11d1-bbc5-0080c76670c0","AD Attribute" +msNPAllowDialin,"db0c9085-c1f2-11d1-bbc5-0080c76670c0","AD Attribute" +msNPCalledStationID,"db0c9089-c1f2-11d1-bbc5-0080c76670c0","AD Attribute" +msNPCallingStationID,"db0c908a-c1f2-11d1-bbc5-0080c76670c0","AD Attribute" +msNPSavedCallingStationID,"db0c908e-c1f2-11d1-bbc5-0080c76670c0","AD Attribute" +msRADIUSCallbackNumber,"db0c909c-c1f2-11d1-bbc5-0080c76670c0","AD Attribute" +msRADIUSFramedIPAddress,"db0c90a4-c1f2-11d1-bbc5-0080c76670c0","AD Attribute" +msRADIUSFramedRoute,"db0c90a9-c1f2-11d1-bbc5-0080c76670c0","AD Attribute" +msRADIUSServiceType,"db0c90b6-c1f2-11d1-bbc5-0080c76670c0","AD Attribute" +msRASSavedCallbackNumber,"db0c90c5-c1f2-11d1-bbc5-0080c76670c0","AD Attribute" +msRASSavedFramedIPAddress,"db0c90c6-c1f2-11d1-bbc5-0080c76670c0","AD Attribute" +msRASSavedFramedRoute,"db0c90c7-c1f2-11d1-bbc5-0080c76670c0","AD Attribute" +mustContain,"bf9679d3-0de6-11d0-a285-00aa003049e2","AD Attribute" +nameServiceFlags,"80212840-4bdc-11d1-a9c4-0000f80367c1","AD Attribute" +nCName,"bf9679d6-0de6-11d0-a285-00aa003049e2","AD Attribute" +nETBIOSName,"bf9679d8-0de6-11d0-a285-00aa003049e2","AD Attribute" +netbootAllowNewClients,"07383076-91df-11d1-aebc-0000f80367c1","AD Attribute" +netbootAnswerOnlyValidClients,"0738307b-91df-11d1-aebc-0000f80367c1","AD Attribute" +netbootAnswerRequests,"0738307a-91df-11d1-aebc-0000f80367c1","AD Attribute" +netbootCurrentClientCount,"07383079-91df-11d1-aebc-0000f80367c1","AD Attribute" +netbootGUID,"3e978921-8c01-11d0-afda-00c04fd930c9","AD Attribute" +netbootDUID,"532570bd-3d77-424f-822f-0d636dc6daad","AD Attribute" +netbootInitialization,"3e978920-8c01-11d0-afda-00c04fd930c9","AD Attribute" +netbootIntelliMirrorOSes,"0738307e-91df-11d1-aebc-0000f80367c1","AD Attribute" +netbootLimitClients,"07383077-91df-11d1-aebc-0000f80367c1","AD Attribute" +netbootLocallyInstalledOSes,"07383080-91df-11d1-aebc-0000f80367c1","AD Attribute" +netbootMachineFilePath,"3e978923-8c01-11d0-afda-00c04fd930c9","AD Attribute" +netbootMaxClients,"07383078-91df-11d1-aebc-0000f80367c1","AD Attribute" +netbootMirrorDataFile,"2df90d85-009f-11d2-aa4c-00c04fd7d83a","AD Attribute" +netbootNewMachineNamingPolicy,"0738307c-91df-11d1-aebc-0000f80367c1","AD Attribute" +netbootNewMachineOU,"0738307d-91df-11d1-aebc-0000f80367c1","AD Attribute" +netbootSCPBL,"07383082-91df-11d1-aebc-0000f80367c1","AD Attribute" +netbootServer,"07383081-91df-11d1-aebc-0000f80367c1","AD Attribute" +netbootSIFFile,"2df90d84-009f-11d2-aa4c-00c04fd7d83a","AD Attribute" +netbootTools,"0738307f-91df-11d1-aebc-0000f80367c1","AD Attribute" +networkAddress,"bf9679d9-0de6-11d0-a285-00aa003049e2","AD Attribute" +nextLevelStore,"bf9679da-0de6-11d0-a285-00aa003049e2","AD Attribute" +nextRid,"bf9679db-0de6-11d0-a285-00aa003049e2","AD Attribute" +nonSecurityMember,"52458018-ca6a-11d0-afff-0000f80367c1","AD Attribute" +nonSecurityMemberBL,"52458019-ca6a-11d0-afff-0000f80367c1","AD Attribute" +notificationList,"19195a56-6da0-11d0-afd3-00c04fd930c9","AD Attribute" +nTGroupMembers,"bf9679df-0de6-11d0-a285-00aa003049e2","AD Attribute" +nTMixedDomain,"3e97891f-8c01-11d0-afda-00c04fd930c9","AD Attribute" +ntPwdHistory,"bf9679e2-0de6-11d0-a285-00aa003049e2","AD Attribute" +nTSecurityDescriptor,"bf9679e3-0de6-11d0-a285-00aa003049e2","AD Attribute" +distinguishedName,"bf9679e4-0de6-11d0-a285-00aa003049e2","AD Attribute" +objectCategory,"26d97369-6070-11d1-a9c6-0000f80367c1","AD Attribute" +objectClass,"bf9679e5-0de6-11d0-a285-00aa003049e2","AD Attribute" +objectClassCategory,"bf9679e6-0de6-11d0-a285-00aa003049e2","AD Attribute" +objectClasses,"9a7ad94b-ca53-11d1-bbd0-0080c76670c0","AD Attribute" +objectCount,"34aaa216-b699-11d0-afee-0000f80367c1","AD Attribute" +objectGUID,"bf9679e7-0de6-11d0-a285-00aa003049e2","AD Attribute" +objectSid,"bf9679e8-0de6-11d0-a285-00aa003049e2","AD Attribute" +objectVersion,"16775848-47f3-11d1-a9c3-0000f80367c1","AD Attribute" +oEMInformation,"bf9679ea-0de6-11d0-a285-00aa003049e2","AD Attribute" +oMObjectClass,"bf9679ec-0de6-11d0-a285-00aa003049e2","AD Attribute" +oMSyntax,"bf9679ed-0de6-11d0-a285-00aa003049e2","AD Attribute" +oMTGuid,"ddac0cf3-af8f-11d0-afeb-00c04fd930c9","AD Attribute" +oMTIndxGuid,"1f0075fa-7e40-11d0-afd6-00c04fd930c9","AD Attribute" +operatingSystem,"3e978925-8c01-11d0-afda-00c04fd930c9","AD Attribute" +operatingSystemHotfix,"bd951b3c-9c96-11d0-afdd-00c04fd930c9","AD Attribute" +operatingSystemServicePack,"3e978927-8c01-11d0-afda-00c04fd930c9","AD Attribute" +operatingSystemVersion,"3e978926-8c01-11d0-afda-00c04fd930c9","AD Attribute" +operatorCount,"bf9679ee-0de6-11d0-a285-00aa003049e2","AD Attribute" +optionDescription,"963d274d-48be-11d1-a9c3-0000f80367c1","AD Attribute" +options,"19195a53-6da0-11d0-afd3-00c04fd930c9","AD Attribute" +optionsLocation,"963d274e-48be-11d1-a9c3-0000f80367c1","AD Attribute" +o,"bf9679ef-0de6-11d0-a285-00aa003049e2","AD Attribute" +ou,"bf9679f0-0de6-11d0-a285-00aa003049e2","AD Attribute" +organizationalStatus,"28596019-7349-4d2f-adff-5a629961f942","AD Attribute" +originalDisplayTable,"5fd424ce-1262-11d0-a060-00aa006c33ed","AD Attribute" +originalDisplayTableMSDOS,"5fd424cf-1262-11d0-a060-00aa006c33ed","AD Attribute" +otherLoginWorkstations,"bf9679f1-0de6-11d0-a285-00aa003049e2","AD Attribute" +otherMailbox,"0296c123-40da-11d1-a9c0-0000f80367c1","AD Attribute" +middleName,"bf9679f2-0de6-11d0-a285-00aa003049e2","AD Attribute" +otherWellKnownObjects,"1ea64e5d-ac0f-11d2-90df-00c04fd91ab1","AD Attribute" +owner,"bf9679f3-0de6-11d0-a285-00aa003049e2","AD Attribute" +packageFlags,"7d6c0e99-7e20-11d0-afd6-00c04fd930c9","AD Attribute" +packageName,"7d6c0e98-7e20-11d0-afd6-00c04fd930c9","AD Attribute" +packageType,"7d6c0e96-7e20-11d0-afd6-00c04fd930c9","AD Attribute" +parentCA,"5245801b-ca6a-11d0-afff-0000f80367c1","AD Attribute" +parentCACertificateChain,"963d2733-48be-11d1-a9c3-0000f80367c1","AD Attribute" +parentGUID,"2df90d74-009f-11d2-aa4c-00c04fd7d83a","AD Attribute" +partialAttributeDeletionList,"28630ec0-41d5-11d1-a9c1-0000f80367c1","AD Attribute" +partialAttributeSet,"19405b9e-3cfa-11d1-a9c0-0000f80367c1","AD Attribute" +pekKeyChangeInterval,"07383084-91df-11d1-aebc-0000f80367c1","AD Attribute" +pekList,"07383083-91df-11d1-aebc-0000f80367c1","AD Attribute" +pendingCACertificates,"963d273c-48be-11d1-a9c3-0000f80367c1","AD Attribute" +pendingParentCA,"963d273e-48be-11d1-a9c3-0000f80367c1","AD Attribute" +perMsgDialogDisplayTable,"5fd424d3-1262-11d0-a060-00aa006c33ed","AD Attribute" +perRecipDialogDisplayTable,"5fd424d4-1262-11d0-a060-00aa006c33ed","AD Attribute" +personalTitle,"16775858-47f3-11d1-a9c3-0000f80367c1","AD Attribute" +otherFacsimileTelephoneNumber,"0296c11d-40da-11d1-a9c0-0000f80367c1","AD Attribute" +otherHomePhone,"f0f8ffa2-1191-11d0-a060-00aa006c33ed","AD Attribute" +homePhone,"f0f8ffa1-1191-11d0-a060-00aa006c33ed","AD Attribute" +otherIpPhone,"4d146e4b-48d4-11d1-a9c3-0000f80367c1","AD Attribute" +ipPhone,"4d146e4a-48d4-11d1-a9c3-0000f80367c1","AD Attribute" +primaryInternationalISDNNumber,"0296c11f-40da-11d1-a9c0-0000f80367c1","AD Attribute" +otherMobile,"0296c11e-40da-11d1-a9c0-0000f80367c1","AD Attribute" +mobile,"f0f8ffa3-1191-11d0-a060-00aa006c33ed","AD Attribute" +otherTelephone,"f0f8ffa5-1191-11d0-a060-00aa006c33ed","AD Attribute" +otherPager,"f0f8ffa4-1191-11d0-a060-00aa006c33ed","AD Attribute" +pager,"f0f8ffa6-1191-11d0-a060-00aa006c33ed","AD Attribute" +photo,"9c979768-ba1a-4c08-9632-c6a5c1ed649a","AD Attribute" +physicalDeliveryOfficeName,"bf9679f7-0de6-11d0-a285-00aa003049e2","AD Attribute" +physicalLocationObject,"b7b13119-b82e-11d0-afee-0000f80367c1","AD Attribute" +thumbnailPhoto,"8d3bca50-1d7e-11d0-a081-00aa006c33ed","AD Attribute" +pKICriticalExtensions,"fc5a9106-3b9d-11d2-90cc-00c04fd91ab1","AD Attribute" +pKIDefaultCSPs,"1ef6336e-3b9e-11d2-90cc-00c04fd91ab1","AD Attribute" +pKIDefaultKeySpec,"426cae6e-3b9d-11d2-90cc-00c04fd91ab1","AD Attribute" +pKIEnrollmentAccess,"926be278-56f9-11d2-90d0-00c04fd91ab1","AD Attribute" +pKIExpirationPeriod,"041570d2-3b9e-11d2-90cc-00c04fd91ab1","AD Attribute" +pKIExtendedKeyUsage,"18976af6-3b9e-11d2-90cc-00c04fd91ab1","AD Attribute" +pKIKeyUsage,"e9b0a87e-3b9d-11d2-90cc-00c04fd91ab1","AD Attribute" +pKIMaxIssuingDepth,"f0bfdefa-3b9d-11d2-90cc-00c04fd91ab1","AD Attribute" +pKIOverlapPeriod,"1219a3ec-3b9e-11d2-90cc-00c04fd91ab1","AD Attribute" +pKT,"8447f9f1-1027-11d0-a05f-00aa006c33ed","AD Attribute" +pKTGuid,"8447f9f0-1027-11d0-a05f-00aa006c33ed","AD Attribute" +policyReplicationFlags,"19405b96-3cfa-11d1-a9c0-0000f80367c1","AD Attribute" +portName,"281416c4-1968-11d0-a28f-00aa003049e2","AD Attribute" +possSuperiors,"bf9679fa-0de6-11d0-a285-00aa003049e2","AD Attribute" +possibleInferiors,"9a7ad94c-ca53-11d1-bbd0-0080c76670c0","AD Attribute" +postOfficeBox,"bf9679fb-0de6-11d0-a285-00aa003049e2","AD Attribute" +postalAddress,"bf9679fc-0de6-11d0-a285-00aa003049e2","AD Attribute" +postalCode,"bf9679fd-0de6-11d0-a285-00aa003049e2","AD Attribute" +preferredDeliveryMethod,"bf9679fe-0de6-11d0-a285-00aa003049e2","AD Attribute" +preferredLanguage,"856be0d0-18e7-46e1-8f5f-7ee4d9020e0d","AD Attribute" +preferredOU,"bf9679ff-0de6-11d0-a285-00aa003049e2","AD Attribute" +prefixMap,"52458022-ca6a-11d0-afff-0000f80367c1","AD Attribute" +presentationAddress,"a8df744b-c5ea-11d1-bbcb-0080c76670c0","AD Attribute" +previousCACertificates,"963d2739-48be-11d1-a9c3-0000f80367c1","AD Attribute" +previousParentCA,"963d273d-48be-11d1-a9c3-0000f80367c1","AD Attribute" +primaryGroupID,"bf967a00-0de6-11d0-a285-00aa003049e2","AD Attribute" +primaryGroupToken,"c0ed8738-7efd-4481-84d9-66d2db8be369","AD Attribute" +printAttributes,"281416d7-1968-11d0-a28f-00aa003049e2","AD Attribute" +printBinNames,"281416cd-1968-11d0-a28f-00aa003049e2","AD Attribute" +printCollate,"281416d2-1968-11d0-a28f-00aa003049e2","AD Attribute" +printColor,"281416d3-1968-11d0-a28f-00aa003049e2","AD Attribute" +printDuplexSupported,"281416cc-1968-11d0-a28f-00aa003049e2","AD Attribute" +printEndTime,"281416ca-1968-11d0-a28f-00aa003049e2","AD Attribute" +printFormName,"281416cb-1968-11d0-a28f-00aa003049e2","AD Attribute" +printKeepPrintedJobs,"ba305f6d-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printLanguage,"281416d6-1968-11d0-a28f-00aa003049e2","AD Attribute" +printMACAddress,"ba305f7a-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printMaxCopies,"281416d1-1968-11d0-a28f-00aa003049e2","AD Attribute" +printMaxResolutionSupported,"281416cf-1968-11d0-a28f-00aa003049e2","AD Attribute" +printMaxXExtent,"ba305f6f-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printMaxYExtent,"ba305f70-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printMediaReady,"3bcbfcf5-4d3d-11d0-a1a6-00c04fd930c9","AD Attribute" +printMediaSupported,"244b296f-5abd-11d0-afd2-00c04fd930c9","AD Attribute" +printMemory,"ba305f74-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printMinXExtent,"ba305f71-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printMinYExtent,"ba305f72-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printNetworkAddress,"ba305f79-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printNotify,"ba305f6a-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printNumberUp,"3bcbfcf4-4d3d-11d0-a1a6-00c04fd930c9","AD Attribute" +printOrientationsSupported,"281416d0-1968-11d0-a28f-00aa003049e2","AD Attribute" +printOwner,"ba305f69-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printPagesPerMinute,"19405b97-3cfa-11d1-a9c0-0000f80367c1","AD Attribute" +printRate,"ba305f77-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printRateUnit,"ba305f78-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printSeparatorFile,"281416c6-1968-11d0-a28f-00aa003049e2","AD Attribute" +printShareName,"ba305f68-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printSpooling,"ba305f6c-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printStaplingSupported,"ba305f73-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printStartTime,"281416c9-1968-11d0-a28f-00aa003049e2","AD Attribute" +printStatus,"ba305f6b-47e3-11d0-a1a6-00c04fd930c9","AD Attribute" +printerName,"244b296e-5abd-11d0-afd2-00c04fd930c9","AD Attribute" +priorSetTime,"bf967a01-0de6-11d0-a285-00aa003049e2","AD Attribute" +priorValue,"bf967a02-0de6-11d0-a285-00aa003049e2","AD Attribute" +priority,"281416c7-1968-11d0-a28f-00aa003049e2","AD Attribute" +privateKey,"bf967a03-0de6-11d0-a285-00aa003049e2","AD Attribute" +privilegeAttributes,"19405b9a-3cfa-11d1-a9c0-0000f80367c1","AD Attribute" +privilegeDisplayName,"19405b98-3cfa-11d1-a9c0-0000f80367c1","AD Attribute" +privilegeHolder,"19405b9b-3cfa-11d1-a9c0-0000f80367c1","AD Attribute" +privilegeValue,"19405b99-3cfa-11d1-a9c0-0000f80367c1","AD Attribute" +productCode,"d9e18317-8939-11d1-aebc-0000f80367c1","AD Attribute" +profilePath,"bf967a05-0de6-11d0-a285-00aa003049e2","AD Attribute" +proxiedObjectName,"e1aea402-cd5b-11d0-afff-0000f80367c1","AD Attribute" +proxyAddresses,"bf967a06-0de6-11d0-a285-00aa003049e2","AD Attribute" +proxyGenerationEnabled,"5fd424d6-1262-11d0-a060-00aa006c33ed","AD Attribute" +proxyLifetime,"bf967a07-0de6-11d0-a285-00aa003049e2","AD Attribute" +publicKeyPolicy,"80a67e28-9f22-11d0-afdd-00c04fd930c9","AD Attribute" +purportedSearch,"b4b54e50-943a-11d1-aebd-0000f80367c1","AD Attribute" +pwdHistoryLength,"bf967a09-0de6-11d0-a285-00aa003049e2","AD Attribute" +pwdLastSet,"bf967a0a-0de6-11d0-a285-00aa003049e2","AD Attribute" +pwdProperties,"bf967a0b-0de6-11d0-a285-00aa003049e2","AD Attribute" +qualityOfService,"80a67e4e-9f22-11d0-afdd-00c04fd930c9","AD Attribute" +queryFilter,"cbf70a26-7e78-11d2-9921-0000f87a57d4","AD Attribute" +queryPolicyBL,"e1aea404-cd5b-11d0-afff-0000f80367c1","AD Attribute" +queryPolicyObject,"e1aea403-cd5b-11d0-afff-0000f80367c1","AD Attribute" +queryPoint,"7bfdcb86-4807-11d1-a9c3-0000f80367c1","AD Attribute" +rangeLower,"bf967a0c-0de6-11d0-a285-00aa003049e2","AD Attribute" +rangeUpper,"bf967a0d-0de6-11d0-a285-00aa003049e2","AD Attribute" +name,"bf967a0e-0de6-11d0-a285-00aa003049e2","AD Attribute" +rDNAttID,"bf967a0f-0de6-11d0-a285-00aa003049e2","AD Attribute" +registeredAddress,"bf967a10-0de6-11d0-a285-00aa003049e2","AD Attribute" +remoteServerName,"bf967a12-0de6-11d0-a285-00aa003049e2","AD Attribute" +remoteSource,"bf967a14-0de6-11d0-a285-00aa003049e2","AD Attribute" +remoteSourceType,"bf967a15-0de6-11d0-a285-00aa003049e2","AD Attribute" +remoteStorageGUID,"2a39c5b0-8960-11d1-aebc-0000f80367c1","AD Attribute" +replPropertyMetaData,"281416c0-1968-11d0-a28f-00aa003049e2","AD Attribute" +replTopologyStayOfExecution,"7bfdcb83-4807-11d1-a9c3-0000f80367c1","AD Attribute" +replUpToDateVector,"bf967a16-0de6-11d0-a285-00aa003049e2","AD Attribute" +replicaSource,"bf967a18-0de6-11d0-a285-00aa003049e2","AD Attribute" +directReports,"bf967a1c-0de6-11d0-a285-00aa003049e2","AD Attribute" +replInterval,"45ba9d1a-56fa-11d2-90d0-00c04fd91ab1","AD Attribute" +repsFrom,"bf967a1d-0de6-11d0-a285-00aa003049e2","AD Attribute" +repsTo,"bf967a1e-0de6-11d0-a285-00aa003049e2","AD Attribute" +requiredCategories,"7d6c0e93-7e20-11d0-afd6-00c04fd930c9","AD Attribute" +retiredReplDSASignatures,"7bfdcb7f-4807-11d1-a9c3-0000f80367c1","AD Attribute" +tokenGroups,"b7c69e6d-2cc7-11d2-854e-00a0c983f608","AD Attribute" +tokenGroupsGlobalAndUniversal,"46a9b11d-60ae-405a-b7e8-ff8a58d456d2","AD Attribute" +tokenGroupsNoGCAcceptable,"040fc392-33df-11d2-98b2-0000f87a57d4","AD Attribute" +revision,"bf967a21-0de6-11d0-a285-00aa003049e2","AD Attribute" +rid,"bf967a22-0de6-11d0-a285-00aa003049e2","AD Attribute" +rIDAllocationPool,"66171889-8f3c-11d0-afda-00c04fd930c9","AD Attribute" +rIDAvailablePool,"66171888-8f3c-11d0-afda-00c04fd930c9","AD Attribute" +rIDManagerReference,"66171886-8f3c-11d0-afda-00c04fd930c9","AD Attribute" +rIDNextRID,"6617188c-8f3c-11d0-afda-00c04fd930c9","AD Attribute" +rIDPreviousAllocationPool,"6617188a-8f3c-11d0-afda-00c04fd930c9","AD Attribute" +rIDSetReferences,"7bfdcb7b-4807-11d1-a9c3-0000f80367c1","AD Attribute" +rIDUsedPool,"6617188b-8f3c-11d0-afda-00c04fd930c9","AD Attribute" +rightsGuid,"8297931c-86d3-11d0-afda-00c04fd930c9","AD Attribute" +roleOccupant,"a8df7465-c5ea-11d1-bbcb-0080c76670c0","AD Attribute" +roomNumber,"81d7f8c2-e327-4a0d-91c6-b42d4009115f","AD Attribute" +rootTrust,"7bfdcb80-4807-11d1-a9c3-0000f80367c1","AD Attribute" +rpcNsAnnotation,"88611bde-8cf4-11d0-afda-00c04fd930c9","AD Attribute" +rpcNsBindings,"bf967a23-0de6-11d0-a285-00aa003049e2","AD Attribute" +rpcNsCodeset,"7a0ba0e0-8e98-11d0-afda-00c04fd930c9","AD Attribute" +rpcNsEntryFlags,"80212841-4bdc-11d1-a9c4-0000f80367c1","AD Attribute" +rpcNsGroup,"bf967a24-0de6-11d0-a285-00aa003049e2","AD Attribute" +rpcNsInterfaceID,"bf967a25-0de6-11d0-a285-00aa003049e2","AD Attribute" +rpcNsObjectID,"29401c48-7a27-11d0-afd6-00c04fd930c9","AD Attribute" +rpcNsPriority,"bf967a27-0de6-11d0-a285-00aa003049e2","AD Attribute" +rpcNsProfileEntry,"bf967a28-0de6-11d0-a285-00aa003049e2","AD Attribute" +rpcNsTransferSyntax,"29401c4a-7a27-11d0-afd6-00c04fd930c9","AD Attribute" +sAMAccountName,"3e0abfd0-126a-11d0-a060-00aa006c33ed","AD Attribute" +sAMAccountType,"6e7b626c-64f2-11d0-afd2-00c04fd930c9","AD Attribute" +samDomainUpdates,"04d2d114-f799-4e9b-bcdc-90e8f5ba7ebe","AD Attribute" +schedule,"dd712224-10e4-11d0-a05f-00aa006c33ed","AD Attribute" +schemaFlagsEx,"bf967a2b-0de6-11d0-a285-00aa003049e2","AD Attribute" +schemaIDGUID,"bf967923-0de6-11d0-a285-00aa003049e2","AD Attribute" +schemaInfo,"f9fb64ae-93b4-11d2-9945-0000f87a57d4","AD Attribute" +schemaUpdate,"1e2d06b4-ac8f-11d0-afe3-00c04fd930c9","AD Attribute" +schemaVersion,"bf967a2c-0de6-11d0-a285-00aa003049e2","AD Attribute" +scopeFlags,"16f3a4c2-7e79-11d2-9921-0000f87a57d4","AD Attribute" +scriptPath,"bf9679a8-0de6-11d0-a285-00aa003049e2","AD Attribute" +sDRightsEffective,"c3dbafa6-33df-11d2-98b2-0000f87a57d4","AD Attribute" +searchFlags,"bf967a2d-0de6-11d0-a285-00aa003049e2","AD Attribute" +searchGuide,"bf967a2e-0de6-11d0-a285-00aa003049e2","AD Attribute" +secretary,"01072d9a-98ad-4a53-9744-e83e287278fb","AD Attribute" +securityIdentifier,"bf967a2f-0de6-11d0-a285-00aa003049e2","AD Attribute" +seeAlso,"bf967a31-0de6-11d0-a285-00aa003049e2","AD Attribute" +seqNotification,"ddac0cf2-af8f-11d0-afeb-00c04fd930c9","AD Attribute" +serialNumber,"bf967a32-0de6-11d0-a285-00aa003049e2","AD Attribute" +serverName,"09dcb7a0-165f-11d0-a064-00aa006c33ed","AD Attribute" +serverReference,"26d9736d-6070-11d1-a9c6-0000f80367c1","AD Attribute" +serverReferenceBL,"26d9736e-6070-11d1-a9c6-0000f80367c1","AD Attribute" +serverRole,"bf967a33-0de6-11d0-a285-00aa003049e2","AD Attribute" +serverState,"bf967a34-0de6-11d0-a285-00aa003049e2","AD Attribute" +serviceBindingInformation,"b7b1311c-b82e-11d0-afee-0000f80367c1","AD Attribute" +serviceClassID,"bf967a35-0de6-11d0-a285-00aa003049e2","AD Attribute" +serviceClassInfo,"bf967a36-0de6-11d0-a285-00aa003049e2","AD Attribute" +serviceClassName,"b7b1311d-b82e-11d0-afee-0000f80367c1","AD Attribute" +serviceDNSName,"28630eb8-41d5-11d1-a9c1-0000f80367c1","AD Attribute" +serviceDNSNameType,"28630eba-41d5-11d1-a9c1-0000f80367c1","AD Attribute" +serviceInstanceVersion,"bf967a37-0de6-11d0-a285-00aa003049e2","AD Attribute" +servicePrincipalName,"f3a64788-5306-11d1-a9c5-0000f80367c1","AD Attribute" +setupCommand,"7d6c0e97-7e20-11d0-afd6-00c04fd930c9","AD Attribute" +shellContextMenu,"553fd039-f32e-11d0-b0bc-00c04fd8dca6","AD Attribute" +shellPropertyPages,"52458039-ca6a-11d0-afff-0000f80367c1","AD Attribute" +shortServerName,"45b01501-c419-11d1-bbc9-0080c76670c0","AD Attribute" +showInAddressBook,"3e74f60e-3e73-11d1-a9c0-0000f80367c1","AD Attribute" +showInAdvancedViewOnly,"bf967984-0de6-11d0-a285-00aa003049e2","AD Attribute" +sIDHistory,"17eb4278-d167-11d0-b002-0000f80367c1","AD Attribute" +signatureAlgorithms,"2a39c5b2-8960-11d1-aebc-0000f80367c1","AD Attribute" +siteGUID,"3e978924-8c01-11d0-afda-00c04fd930c9","AD Attribute" +siteLinkList,"d50c2cdd-8951-11d1-aebc-0000f80367c1","AD Attribute" +siteList,"d50c2cdc-8951-11d1-aebc-0000f80367c1","AD Attribute" +siteObject,"3e10944c-c354-11d0-aff8-0000f80367c1","AD Attribute" +siteObjectBL,"3e10944d-c354-11d0-aff8-0000f80367c1","AD Attribute" +siteServer,"1be8f17c-a9ff-11d0-afe2-00c04fd930c9","AD Attribute" +mailAddress,"26d9736f-6070-11d1-a9c6-0000f80367c1","AD Attribute" +sPNMappings,"2ab0e76c-7041-11d2-9905-0000f87a57d4","AD Attribute" +st,"bf967a39-0de6-11d0-a285-00aa003049e2","AD Attribute" +street,"bf967a3a-0de6-11d0-a285-00aa003049e2","AD Attribute" +structuralObjectClass,"3860949f-f6a8-4b38-9950-81ecb6bc2982","AD Attribute" +subClassOf,"bf967a3b-0de6-11d0-a285-00aa003049e2","AD Attribute" +subRefs,"bf967a3c-0de6-11d0-a285-00aa003049e2","AD Attribute" +subSchemaSubEntry,"9a7ad94d-ca53-11d1-bbd0-0080c76670c0","AD Attribute" +superScopeDescription,"963d274c-48be-11d1-a9c3-0000f80367c1","AD Attribute" +superScopes,"963d274b-48be-11d1-a9c3-0000f80367c1","AD Attribute" +superiorDNSRoot,"5245801d-ca6a-11d0-afff-0000f80367c1","AD Attribute" +supplementalCredentials,"bf967a3f-0de6-11d0-a285-00aa003049e2","AD Attribute" +supportedApplicationContext,"1677588f-47f3-11d1-a9c3-0000f80367c1","AD Attribute" +sn,"bf967a41-0de6-11d0-a285-00aa003049e2","AD Attribute" +syncAttributes,"037651e4-441d-11d1-a9c3-0000f80367c1","AD Attribute" +syncMembership,"037651e3-441d-11d1-a9c3-0000f80367c1","AD Attribute" +syncWithObject,"037651e2-441d-11d1-a9c3-0000f80367c1","AD Attribute" +syncWithSID,"037651e5-441d-11d1-a9c3-0000f80367c1","AD Attribute" +systemAuxiliaryClass,"bf967a43-0de6-11d0-a285-00aa003049e2","AD Attribute" +systemFlags,"e0fa1e62-9b45-11d0-afdd-00c04fd930c9","AD Attribute" +systemMayContain,"bf967a44-0de6-11d0-a285-00aa003049e2","AD Attribute" +systemMustContain,"bf967a45-0de6-11d0-a285-00aa003049e2","AD Attribute" +systemOnly,"bf967a46-0de6-11d0-a285-00aa003049e2","AD Attribute" +systemPossSuperiors,"bf967a47-0de6-11d0-a285-00aa003049e2","AD Attribute" +telephoneNumber,"bf967a49-0de6-11d0-a285-00aa003049e2","AD Attribute" +teletexTerminalIdentifier,"bf967a4a-0de6-11d0-a285-00aa003049e2","AD Attribute" +telexNumber,"bf967a4b-0de6-11d0-a285-00aa003049e2","AD Attribute" +primaryTelexNumber,"0296c121-40da-11d1-a9c0-0000f80367c1","AD Attribute" +templateRoots,"ed9de9a0-7041-11d2-9905-0000f87a57d4","AD Attribute" +terminalServer,"6db69a1c-9422-11d1-aebd-0000f80367c1","AD Attribute" +co,"f0f8ffa7-1191-11d0-a060-00aa006c33ed","AD Attribute" +textEncodedORAddress,"a8df7489-c5ea-11d1-bbcb-0080c76670c0","AD Attribute" +timeRefresh,"ddac0cf1-af8f-11d0-afeb-00c04fd930c9","AD Attribute" +timeVolChange,"ddac0cf0-af8f-11d0-afeb-00c04fd930c9","AD Attribute" +title,"bf967a55-0de6-11d0-a285-00aa003049e2","AD Attribute" +tombstoneLifetime,"16c3a860-1273-11d0-a060-00aa006c33ed","AD Attribute" +transportAddressAttribute,"c1dc867c-a261-11d1-b606-0000f80367c1","AD Attribute" +transportDLLName,"26d97372-6070-11d1-a9c6-0000f80367c1","AD Attribute" +transportType,"26d97374-6070-11d1-a9c6-0000f80367c1","AD Attribute" +treatAsLeaf,"8fd044e3-771f-11d1-aeae-0000f80367c1","AD Attribute" +treeName,"28630ebd-41d5-11d1-a9c1-0000f80367c1","AD Attribute" +trustAttributes,"80a67e5a-9f22-11d0-afdd-00c04fd930c9","AD Attribute" +trustAuthIncoming,"bf967a59-0de6-11d0-a285-00aa003049e2","AD Attribute" +trustAuthOutgoing,"bf967a5f-0de6-11d0-a285-00aa003049e2","AD Attribute" +trustDirection,"bf967a5c-0de6-11d0-a285-00aa003049e2","AD Attribute" +trustParent,"b000ea7a-a086-11d0-afdd-00c04fd930c9","AD Attribute" +trustPartner,"bf967a5d-0de6-11d0-a285-00aa003049e2","AD Attribute" +trustPosixOffset,"bf967a5e-0de6-11d0-a285-00aa003049e2","AD Attribute" +trustType,"bf967a60-0de6-11d0-a285-00aa003049e2","AD Attribute" +uASCompat,"bf967a61-0de6-11d0-a285-00aa003049e2","AD Attribute" +uid,"0bb0fca0-1e89-429f-901a-1413894d9f59","AD Attribute" +uNCName,"bf967a64-0de6-11d0-a285-00aa003049e2","AD Attribute" +unicodePwd,"bf9679e1-0de6-11d0-a285-00aa003049e2","AD Attribute" +uniqueIdentifier,"ba0184c7-38c5-4bed-a526-75421470580c","AD Attribute" +uniqueMember,"8f888726-f80a-44d7-b1ee-cb9df21392c8","AD Attribute" +unstructuredAddress,"50950839-cc4c-4491-863a-fcf942d684b7","AD Attribute" +unstructuredName,"9c8ef177-41cf-45c9-9673-7716c0c8901b","AD Attribute" +upgradeProductCode,"d9e18312-8939-11d1-aebc-0000f80367c1","AD Attribute" +uPNSuffixes,"032160bf-9824-11d1-aec0-0000f80367c1","AD Attribute" +userAccountControl,"bf967a68-0de6-11d0-a285-00aa003049e2","AD Attribute" +userCert,"bf967a69-0de6-11d0-a285-00aa003049e2","AD Attribute" +comment,"bf967a6a-0de6-11d0-a285-00aa003049e2","AD Attribute" +userParameters,"bf967a6d-0de6-11d0-a285-00aa003049e2","AD Attribute" +userPassword,"bf967a6e-0de6-11d0-a285-00aa003049e2","AD Attribute" +userClass,"11732a8a-e14d-4cc5-b92f-d93f51c6d8e4","AD Attribute" +userPKCS12,"23998ab5-70f8-4007-a4c1-a84a38311f9a","AD Attribute" +userPrincipalName,"28630ebb-41d5-11d1-a9c1-0000f80367c1","AD Attribute" +userSharedFolder,"9a9a021f-4a5b-11d1-a9c3-0000f80367c1","AD Attribute" +userSharedFolderOther,"9a9a0220-4a5b-11d1-a9c3-0000f80367c1","AD Attribute" +userSMIMECertificate,"e16a9db2-403c-11d1-a9c0-0000f80367c1","AD Attribute" +userWorkstations,"bf9679d7-0de6-11d0-a285-00aa003049e2","AD Attribute" +uSNChanged,"bf967a6f-0de6-11d0-a285-00aa003049e2","AD Attribute" +uSNCreated,"bf967a70-0de6-11d0-a285-00aa003049e2","AD Attribute" +uSNDSALastObjRemoved,"bf967a71-0de6-11d0-a285-00aa003049e2","AD Attribute" +USNIntersite,"a8df7498-c5ea-11d1-bbcb-0080c76670c0","AD Attribute" +uSNLastObjRem,"bf967a73-0de6-11d0-a285-00aa003049e2","AD Attribute" +uSNSource,"167758ad-47f3-11d1-a9c3-0000f80367c1","AD Attribute" +validAccesses,"4d2fa380-7f54-11d2-992a-0000f87a57d4","AD Attribute" +vendor,"281416df-1968-11d0-a28f-00aa003049e2","AD Attribute" +versionNumber,"bf967a76-0de6-11d0-a285-00aa003049e2","AD Attribute" +versionNumberHi,"7d6c0e9a-7e20-11d0-afd6-00c04fd930c9","AD Attribute" +versionNumberLo,"7d6c0e9b-7e20-11d0-afd6-00c04fd930c9","AD Attribute" +volTableGUID,"1f0075fd-7e40-11d0-afd6-00c04fd930c9","AD Attribute" +volTableIdxGUID,"1f0075fb-7e40-11d0-afd6-00c04fd930c9","AD Attribute" +volumeCount,"34aaa217-b699-11d0-afee-0000f80367c1","AD Attribute" +wbemPath,"244b2970-5abd-11d0-afd2-00c04fd930c9","AD Attribute" +wellKnownObjects,"05308983-7688-11d1-aded-00c04fd8d5cd","AD Attribute" +whenChanged,"bf967a77-0de6-11d0-a285-00aa003049e2","AD Attribute" +whenCreated,"bf967a78-0de6-11d0-a285-00aa003049e2","AD Attribute" +winsockAddresses,"bf967a79-0de6-11d0-a285-00aa003049e2","AD Attribute" +wWWHomePage,"bf967a7a-0de6-11d0-a285-00aa003049e2","AD Attribute" +url,"9a9a0221-4a5b-11d1-a9c3-0000f80367c1","AD Attribute" +x121Address,"bf967a7b-0de6-11d0-a285-00aa003049e2","AD Attribute" +x500uniqueIdentifier,"d07da11f-8a3d-42b6-b0aa-76c962be719a","AD Attribute" +userCertificate,"bf967a7f-0de6-11d0-a285-00aa003049e2","AD Attribute" +unixUserPassword,"612cb747-c0e8-4f92-9221-fdd5f15b550d","AD Attribute" +uidNumber,"850fcc8f-9c6b-47e1-b671-7c654be4d5b3","AD Attribute" +gidNumber,"c5b95f0c-ec9e-41c4-849c-b46597ed6696","AD Attribute" +gecos,"a3e03f1f-1d55-4253-a0af-30c2a784e46e","AD Attribute" +unixHomeDirectory,"bc2dba12-000f-464d-bf1d-0808465d8843","AD Attribute" +loginShell,"a553d12c-3231-4c5e-8adf-8d189697721e","AD Attribute" +shadowLastChange,"f8f2689c-29e8-4843-8177-e8b98e15eeac","AD Attribute" +shadowMin,"a76b8737-e5a1-4568-b057-dc12e04be4b2","AD Attribute" +shadowMax,"f285c952-50dd-449e-9160-3b880d99988d","AD Attribute" +shadowWarning,"7ae89c9c-2976-4a46-bb8a-340f88560117","AD Attribute" +shadowInactive,"86871d1f-3310-4312-8efd-af49dcfb2671","AD Attribute" +shadowExpire,"75159a00-1fff-4cf4-8bff-4ef2695cf643","AD Attribute" +shadowFlag,"8dfeb70d-c5db-46b6-b15e-a4389e6cee9b","AD Attribute" +memberUid,"03dab236-672e-4f61-ab64-f77d2dc2ffab","AD Attribute" +memberNisNetgroup,"0f6a17dc-53e5-4be8-9442-8f3ce2f9012a","AD Attribute" +nisNetgroupTriple,"a8032e74-30ef-4ff5-affc-0fc217783fec","AD Attribute" +ipServicePort,"ff2daebf-f463-495a-8405-3e483641eaa2","AD Attribute" +ipServiceProtocol,"cd96ec0b-1ed6-43b4-b26b-f170b645883f","AD Attribute" +ipProtocolNumber,"ebf5c6eb-0e2d-4415-9670-1081993b4211","AD Attribute" +oncRpcNumber,"966825f5-01d9-4a5c-a011-d15ae84efa55","AD Attribute" +ipHostNumber,"de8bb721-85dc-4fde-b687-9657688e667e","AD Attribute" +ipNetworkNumber,"4e3854f4-3087-42a4-a813-bb0c528958d3","AD Attribute" +ipNetmaskNumber,"6ff64fcd-462e-4f62-b44a-9a5347659eb9","AD Attribute" +macAddress,"e6a522dd-9770-43e1-89de-1de5044328f7","AD Attribute" +bootParameter,"d72a0750-8c7c-416e-8714-e65f11e908be","AD Attribute" +bootFile,"e3f3cb4e-0f20-42eb-9703-d2ff26e52667","AD Attribute" +nisMapName,"969d3c79-0e9a-4d95-b0ac-bdde7ff8f3a1","AD Attribute" +nisMapEntry,"4a95216e-fcc0-402e-b57f-5971626148a9","AD Attribute" +msSFU30SearchContainer,"27eebfa2-fbeb-4f8e-aad6-c50247994291","AD Attribute" +msSFU30KeyAttributes,"32ecd698-ce9e-4894-a134-7ad76b082e83","AD Attribute" +msSFU30FieldSeparator,"a2e11a42-e781-4ca1-a7fa-ec307f62b6a1","AD Attribute" +msSFU30IntraFieldSeparator,"95b2aef0-27e4-4cb9-880a-a2d9a9ea23b8","AD Attribute" +msSFU30SearchAttributes,"ef9a2df0-2e57-48c8-8950-0cc674004733","AD Attribute" +msSFU30ResultAttributes,"e167b0b6-4045-4433-ac35-53f972d45cba","AD Attribute" +msSFU30MapFilter,"b7b16e01-024f-4e23-ad0d-71f1a406b684","AD Attribute" +msSFU30MasterServerName,"4cc908a2-9e18-410e-8459-f17cc422020a","AD Attribute" +msSFU30OrderNumber,"02625f05-d1ee-4f9f-b366-55266becb95c","AD Attribute" +msSFU30Name,"16c5d1d3-35c2-4061-a870-a5cefda804f0","AD Attribute" +msSFU30Aliases,"20ebf171-c69a-4c31-b29d-dcb837d8912d","AD Attribute" +msSFU30KeyValues,"37830235-e5e9-46f2-922b-d8d44f03e7ae","AD Attribute" +msSFU30NisDomain,"9ee3b2e3-c7f3-45f8-8c9f-1382be4984d2","AD Attribute" +msSFU30Domains,"93095ed3-6f30-4bdd-b734-65d569f5f7c9","AD Attribute" +msSFU30YpServers,"084a944b-e150-4bfe-9345-40e1aedaebba","AD Attribute" +msSFU30MaxGidNumber,"04ee6aa6-f83b-469a-bf5a-3c00d3634669","AD Attribute" +msSFU30MaxUidNumber,"ec998437-d944-4a28-8500-217588adfc75","AD Attribute" +msSFU30NSMAPFieldPosition,"585c9d5e-f599-4f07-9cf9-4373af4b89d3","AD Attribute" +msSFU30PosixMember,"c875d82d-2848-4cec-bb50-3c5486d09d57","AD Attribute" +msSFU30PosixMemberOf,"7bd76b92-3244-438a-ada6-24f5ea34381e","AD Attribute" +msSFU30NetgroupHostAtDomain,"97d2bf65-0466-4852-a25a-ec20f57ee36c","AD Attribute" +msSFU30NetgroupUserAtDomain,"a9e84eed-e630-4b67-b4b3-cad2a82d345e","AD Attribute" +msSFU30IsValidContainer,"0dea42f5-278d-4157-b4a7-49b59664915b","AD Attribute" +msSFU30CryptMethod,"4503d2a3-3d70-41b8-b077-dff123c15865","AD Attribute" +msTSProfilePath,"e65c30db-316c-4060-a3a0-387b083f09cd","AD Attribute" +msTSHomeDirectory,"5d3510f0-c4e7-4122-b91f-a20add90e246","AD Attribute" +msTSHomeDrive,"5f0a24d9-dffa-4cd9-acbf-a0680c03731e","AD Attribute" +msTSAllowLogon,"3a0cd464-bc54-40e7-93ae-a646a6ecc4b4","AD Attribute" +msTSRemoteControl,"15177226-8642-468b-8c48-03ddfd004982","AD Attribute" +msTSMaxDisconnectionTime,"326f7089-53d8-4784-b814-46d8535110d2","AD Attribute" +msTSMaxConnectionTime,"1d960ee2-6464-4e95-a781-e3b5cd5f9588","AD Attribute" +msTSMaxIdleTime,"ff739e9c-6bb7-460e-b221-e250f3de0f95","AD Attribute" +msTSReconnectionAction,"366ed7ca-3e18-4c7f-abae-351a01e4b4f7","AD Attribute" +msTSBrokenConnectionAction,"1cf41bba-5604-463e-94d6-1a1287b72ca3","AD Attribute" +msTSConnectClientDrives,"23572aaf-29dd-44ea-b0fa-7e8438b9a4a3","AD Attribute" +msTSConnectPrinterDrives,"8ce6a937-871b-4c92-b285-d99d4036681c","AD Attribute" +msTSDefaultToMainPrinter,"c0ffe2bd-cacf-4dc7-88d5-61e9e95766f6","AD Attribute" +msTSWorkDirectory,"a744f666-3d3c-4cc8-834b-9d4f6f687b8b","AD Attribute" +msTSInitialProgram,"9201ac6f-1d69-4dfb-802e-d95510109599","AD Attribute" +msTSEndpointData,"40e1c407-4344-40f3-ab43-3625a34a63a2","AD Attribute" +msTSEndpointType,"377ade80-e2d8-46c5-9bcd-6d9dec93b35e","AD Attribute" +msTSEndpointPlugin,"3c08b569-801f-4158-b17b-e363d6ae696a","AD Attribute" +msTSPrimaryDesktop,"29259694-09e4-4237-9f72-9306ebe63ab2","AD Attribute" +msTSSecondaryDesktops,"f63aa29a-bb31-48e1-bfab-0a6c5a1d39c2","AD Attribute" +msTSPrimaryDesktopBL,"9daadc18-40d1-4ed1-a2bf-6b9bf47d3daa","AD Attribute" +msTSSecondaryDesktopBL,"34b107af-a00a-455a-b139-dd1a1b12d8af","AD Attribute" +msTSProperty01,"faaea977-9655-49d7-853d-f27bb7aaca0f","AD Attribute" +msTSProperty02,"3586f6ac-51b7-4978-ab42-f936463198e7","AD Attribute" +msTSExpireDate,"70004ef5-25c3-446a-97c8-996ae8566776","AD Attribute" +msTSExpireDate2,"54dfcf71-bc3f-4f0b-9d5a-4b2476bb8925","AD Attribute" +msTSExpireDate3,"41bc7f04-be72-4930-bd10-1f3439412387","AD Attribute" +msTSExpireDate4,"5e11dc43-204a-4faf-a008-6863621c6f5f","AD Attribute" +msTSLicenseVersion,"0ae94a89-372f-4df2-ae8a-c64a2bc47278","AD Attribute" +msTSLicenseVersion2,"4b0df103-8d97-45d9-ad69-85c3080ba4e7","AD Attribute" +msTSLicenseVersion3,"f8ba8f81-4cab-4973-a3c8-3a6da62a5e31","AD Attribute" +msTSLicenseVersion4,"70ca5d97-2304-490a-8a27-52678c8d2095","AD Attribute" +msTSManagingLS,"f3bcc547-85b0-432c-9ac0-304506bf2c83","AD Attribute" +msTSManagingLS2,"349f0757-51bd-4fc8-9d66-3eceea8a25be","AD Attribute" +msTSManagingLS3,"fad5dcc1-2130-4c87-a118-75322cd67050","AD Attribute" +msTSManagingLS4,"f7a3b6a0-2107-4140-b306-75cb521731e5","AD Attribute" +msTSLSProperty01,"87e53590-971d-4a52-955b-4794d15a84ae","AD Attribute" +msTSLSProperty02,"47c77bb0-316e-4e2f-97f1-0d4c48fca9dd","AD Attribute" +"msDFSR-DisablePacketPrivacy","6a84ede5-741e-43fd-9dd6-aa0f61578621","AD Attribute" +"msDFSR-DefaultCompressionExclusionFilter","87811bd5-cd8b-45cb-9f5d-980f3a9e0c97","AD Attribute" +"msDFSR-OnDemandExclusionFileFilter","a68359dc-a581-4ee6-9015-5382c60f0fb4","AD Attribute" +"msDFSR-OnDemandExclusionDirectoryFilter","7d523aff-9012-49b2-9925-f922a0018656","AD Attribute" +"msDFSR-Options2","11e24318-4ca6-4f49-9afe-e5eb1afa3473","AD Attribute" +"msDFSR-CommonStagingPath","936eac41-d257-4bb9-bd55-f310a3cf09ad","AD Attribute" +"msDFSR-CommonStagingSizeInMb","135eb00e-4846-458b-8ea2-a37559afd405","AD Attribute" +"msDFSR-StagingCleanupTriggerInPercent","d64b9c23-e1fa-467b-b317-6964d744d633","AD Attribute" +"msDFS-Commentv2","b786cec9-61fd-4523-b2c1-5ceb3860bb32","AD Attribute" +"msDFS-GenerationGUIDv2","35b8b3d9-c58f-43d6-930e-5040f2f1a781","AD Attribute" +"msDFS-LastModifiedv2","3c095e8a-314e-465b-83f5-ab8277bcf29b","AD Attribute" +"msDFS-LinkIdentityGUIDv2","edb027f3-5726-4dee-8d4e-dbf07e1ad1f1","AD Attribute" +"msDFS-LinkPathv2","86b021f6-10ab-40a2-a252-1dc0cc3be6a9","AD Attribute" +"msDFS-LinkSecurityDescriptorv2","57cf87f7-3426-4841-b322-02b3b6e9eba8","AD Attribute" +"msDFS-NamespaceIdentityGUIDv2","200432ce-ec5f-4931-a525-d7f4afe34e68","AD Attribute" +"msDFS-Propertiesv2","0c3e5bc5-eb0e-40f5-9b53-334e958dffdb","AD Attribute" +"msDFS-SchemaMajorVersion","ec6d7855-704a-4f61-9aa6-c49a7c1d54c7","AD Attribute" +"msDFS-SchemaMinorVersion","fef9a725-e8f1-43ab-bd86-6a0115ce9e38","AD Attribute" +"msDFS-ShortNameLinkPathv2","2d7826f0-4cf7-42e9-a039-1110e0d9ca99","AD Attribute" +"msDFS-TargetListv2","6ab126c6-fa41-4b36-809e-7ca91610d48f","AD Attribute" +"msDFS-Ttlv2","ea944d31-864a-4349-ada5-062e2c614f5e","AD Attribute" +"msDS-BridgeHeadServersUsed","3ced1465-7b71-2541-8780-1e1ea6243a82","AD Attribute" +"msDS-IsUsedAsResourceSecurityAttribute","51c9f89d-4730-468d-a2b5-1d493212d17e","AD Attribute" +"msDS-ClaimPossibleValues","2e28edee-ed7c-453f-afe4-93bd86f2174f","AD Attribute" +"msDS-ClaimValueType","c66217b9-e48e-47f7-b7d5-6552b8afd619","AD Attribute" +"msDS-ClaimAttributeSource","eebc123e-bae6-4166-9e5b-29884a8b76b0","AD Attribute" +"msDS-ClaimTypeAppliesToClass","6afb0e4c-d876-437c-aeb6-c3e41454c272","AD Attribute" +"msDS-ClaimSharesPossibleValuesWith","52c8d13a-ce0b-4f57-892b-18f5a43a2400","AD Attribute" +"msDS-ClaimSharesPossibleValuesWithBL","54d522db-ec95-48f5-9bbd-1880ebbb2180","AD Attribute" +"msDS-MembersOfResourcePropertyList","4d371c11-4cad-4c41-8ad2-b180ab2bd13c","AD Attribute" +"msDS-MembersOfResourcePropertyListBL","7469b704-edb0-4568-a5a5-59f4862c75a7","AD Attribute" +"msSPP-CSVLKPid","b47f510d-6b50-47e1-b556-772c79e4ffc4","AD Attribute" +"msSPP-CSVLKPartialProductKey","a601b091-8652-453a-b386-87ad239b7c08","AD Attribute" +"msSPP-CSVLKSkuId","9684f739-7b78-476d-8d74-31ad7692eef4","AD Attribute" +"msSPP-KMSIds","9b663eda-3542-46d6-9df0-314025af2bac","AD Attribute" +"msSPP-InstallationId","69bfb114-407b-4739-a213-c663802b3e37","AD Attribute" +"msSPP-ConfirmationId","6e8797c4-acda-4a49-8740-b0bd05a9b831","AD Attribute" +"msSPP-OnlineLicense","098f368e-4812-48cd-afb7-a136b96807ed","AD Attribute" +"msSPP-PhoneLicense","67e4d912-f362-4052-8c79-42f45ba7b221","AD Attribute" +"msSPP-ConfigLicense","0353c4b5-d199-40b0-b3c5-deb32fd9ec06","AD Attribute" +"msSPP-IssuanceLicense","1075b3a1-bbaf-49d2-ae8d-c4f25c823303","AD Attribute" +"msTPM-SrkPubThumbprint","19d706eb-4d76-44a2-85d6-1c342be3be37","AD Attribute" +"msTPM-OwnerInformationTemp","c894809d-b513-4ff8-8811-f4f43f5ac7bc","AD Attribute" +"msTPM-TpmInformationForComputer","ea1b7b93-5e48-46d5-bc6c-4df4fda78a35","AD Attribute" +"msTPM-TpmInformationForComputerBL","14fa84c9-8ecd-4348-bc91-6d3ced472ab7","AD Attribute" +"msDNS-KeymasterZones","0be0dd3b-041a-418c-ace9-2f17d23e9d42","AD Attribute" +"msDNS-IsSigned","aa12854c-d8fc-4d5e-91ca-368b8d829bee","AD Attribute" +"msDNS-SignWithNSEC3","c79f2199-6da1-46ff-923c-1f3f800c721e","AD Attribute" +"msDNS-NSEC3OptOut","7bea2088-8ce2-423c-b191-66ec506b1595","AD Attribute" +"msDNS-MaintainTrustAnchor","0dc063c1-52d9-4456-9e15-9c2434aafd94","AD Attribute" +"msDNS-DSRecordAlgorithms","5c5b7ad2-20fa-44bb-beb3-34b9c0f65579","AD Attribute" +"msDNS-RFC5011KeyRollovers","27d93c40-065a-43c0-bdd8-cdf2c7d120aa","AD Attribute" +"msDNS-NSEC3HashAlgorithm","ff9e5552-7db7-4138-8888-05ce320a0323","AD Attribute" +"msDNS-NSEC3RandomSaltLength","13361665-916c-4de7-a59d-b1ebbd0de129","AD Attribute" +"msDNS-NSEC3Iterations","80b70aab-8959-4ec0-8e93-126e76df3aca","AD Attribute" +"msDNS-DNSKEYRecordSetTTL","8f4e317f-28d7-442c-a6df-1f491f97b326","AD Attribute" +"msDNS-DSRecordSetTTL","29869b7c-64c4-42fe-97d5-fbc2fa124160","AD Attribute" +"msDNS-SignatureInceptionOffset","03d4c32e-e217-4a61-9699-7bbc4729a026","AD Attribute" +"msDNS-SecureDelegationPollingPeriod","f6b0f0be-a8e4-4468-8fd9-c3c47b8722f9","AD Attribute" +"msDNS-SigningKeyDescriptors","3443d8cd-e5b6-4f3b-b098-659a0214a079","AD Attribute" +"msDNS-SigningKeys","b7673e6d-cad9-4e9e-b31a-63e8098fdd63","AD Attribute" +"msDNS-DNSKEYRecords","28c458f5-602d-4ac9-a77c-b3f1be503a7e","AD Attribute" +"msDNS-ParentHasSecureDelegation","285c6964-c11a-499e-96d8-bf7c75a223c6","AD Attribute" +"msDNS-PropagationTime","ba340d47-2181-4ca0-a2f6-fae4479dab2a","AD Attribute" +"msDNS-NSEC3UserSalt","aff16770-9622-4fbc-a128-3088777605b9","AD Attribute" +"msDNS-NSEC3CurrentSalt","387d9432-a6d1-4474-82cd-0a89aae084ae","AD Attribute" +"msAuthz-EffectiveSecurityPolicy","07831919-8f94-4fb6-8a42-91545dccdad3","AD Attribute" +"msAuthz-ProposedSecurityPolicy","b946bece-09b5-4b6a-b25a-4b63a330e80e","AD Attribute" +"msAuthz-LastEffectiveSecurityPolicy","8e1685c6-3e2f-48a2-a58d-5af0ea789fa0","AD Attribute" +"msAuthz-ResourceCondition","80997877-f874-4c68-864d-6e508a83bdbd","AD Attribute" +"msAuthz-CentralAccessPolicyID","62f29b60-be74-4630-9456-2f6691993a86","AD Attribute" +"msAuthz-MemberRulesInCentralAccessPolicy","57f22f7a-377e-42c3-9872-cec6f21d2e3e","AD Attribute" +"msAuthz-MemberRulesInCentralAccessPolicyBL","516e67cf-fedd-4494-bb3a-bc506a948891","AD Attribute" +"msDS-ClaimSource","fa32f2a6-f28b-47d0-bf91-663e8f910a72","AD Attribute" +"msDS-ClaimSourceType","92f19c05-8dfa-4222-bbd1-2c4f01487754","AD Attribute" +"msDS-ClaimIsValueSpaceRestricted","0c2ce4c7-f1c3-4482-8578-c60d4bb74422","AD Attribute" +"msDS-ClaimIsSingleValued","cd789fb9-96b4-4648-8219-ca378161af38","AD Attribute" +"msDS-GenerationId","1e5d393d-8cb7-4b4f-840a-973b36cc09c3","AD Attribute" +"msDS-PrimaryComputer","a13df4e2-dbb0-4ceb-828b-8b2e143e9e81","AD Attribute" +"msDS-IsPrimaryComputerFor","998c06ac-3f87-444e-a5df-11b03dc8a50c","AD Attribute" +"msKds-KDFAlgorithmID","db2c48b2-d14d-ec4e-9f58-ad579d8b440e","AD Attribute" +"msKds-KDFParam","8a800772-f4b8-154f-b41c-2e4271eff7a7","AD Attribute" +"msKds-SecretAgreementAlgorithmID","1702975d-225e-cb4a-b15d-0daea8b5e990","AD Attribute" +"msKds-SecretAgreementParam","30b099d9-edfe-7549-b807-eba444da79e9","AD Attribute" +"msKds-PublicKeyLength","e338f470-39cd-4549-ab5b-f69f9e583fe0","AD Attribute" +"msKds-PrivateKeyLength","615f42a1-37e7-1148-a0dd-3007e09cfc81","AD Attribute" +"msKds-RootKeyData","26627c27-08a2-0a40-a1b1-8dce85b42993","AD Attribute" +"msKds-Version","d5f07340-e6b0-1e4a-97be-0d3318bd9db1","AD Attribute" +"msKds-DomainID","96400482-cf07-e94c-90e8-f2efc4f0495e","AD Attribute" +"msKds-UseStartTime","6cdc047f-f522-b74a-9a9c-d95ac8cdfda2","AD Attribute" +"msKds-CreateTime","ae18119f-6390-0045-b32d-97dbc701aef7","AD Attribute" +"msImaging-ThumbprintHash","9cdfdbc5-0304-4569-95f6-c4f663fe5ae6","AD Attribute" +"msImaging-HashAlgorithm","8ae70db5-6406-4196-92fe-f3bb557520a7","AD Attribute" +"msDS-AllowedToActOnBehalfOfOtherIdentity","3f78c3e5-f79a-46bd-a0b8-9d18116ddc79","AD Attribute" +"msDS-ManagedPassword","e362ed86-b728-0842-b27d-2dea7a9df218","AD Attribute" +"msDS-ManagedPasswordId","0e78295a-c6d3-0a40-b491-d62251ffa0a6","AD Attribute" +"msDS-ManagedPasswordPreviousId","d0d62131-2d4a-d04f-99d9-1c63646229a4","AD Attribute" +"msDS-ManagedPasswordInterval","f8758ef7-ac76-8843-a2ee-a26b4dcaf409","AD Attribute" +"msDS-GroupMSAMembership","888eedd6-ce04-df40-b462-b8a50e41ba38","AD Attribute" +"msDS-GeoCoordinatesAltitude","a11703b7-5641-4d9c-863e-5fb3325e74e0","AD Attribute" +"msDS-GeoCoordinatesLatitude","dc66d44e-3d43-40f5-85c5-3c12e169927e","AD Attribute" +"msDS-GeoCoordinatesLongitude","94c42110-bae4-4cea-8577-af813af5da25","AD Attribute" +"msDS-TransformationRules","55872b71-c4b2-3b48-ae51-4095f91ec600","AD Attribute" +"msDS-IngressClaimsTransformationPolicy","86284c08-0c6e-1540-8b15-75147d23d20d","AD Attribute" +"msDS-EgressClaimsTransformationPolicy","c137427e-9a73-b040-9190-1b095bb43288","AD Attribute" +"msDS-TDOEgressBL","d5006229-9913-2242-8b17-83761d1e0e5b","AD Attribute" +"msDS-TDOIngressBL","5a5661a1-97c6-544b-8056-e430fe7bc554","AD Attribute" +"msDS-TransformationRulesCompiled","0bb49a10-536b-bc4d-a273-0bab0dd4bd10","AD Attribute" +"msDS-AppliesToResourceTypes","693f2006-5764-3d4a-8439-58f04aab4b59","AD Attribute" +"msDS-RIDPoolAllocationEnabled","24977c8c-c1b7-3340-b4f6-2b375eb711d7","AD Attribute" +"msDS-cloudExtensionAttribute1","9709eaaf-49da-4db2-908a-0446e5eab844","AD Attribute" +"msDS-cloudExtensionAttribute2","f34ee0ac-c0c1-4ba9-82c9-1a90752f16a5","AD Attribute" +"msDS-cloudExtensionAttribute3","82f6c81a-fada-4a0d-b0f7-706d46838eb5","AD Attribute" +"msDS-cloudExtensionAttribute4","9cbf3437-4e6e-485b-b291-22b02554273f","AD Attribute" +"msDS-cloudExtensionAttribute5","2915e85b-e347-4852-aabb-22e5a651c864","AD Attribute" +"msDS-cloudExtensionAttribute6","60452679-28e1-4bec-ace3-712833361456","AD Attribute" +"msDS-cloudExtensionAttribute7","4a7c1319-e34e-40c2-9d00-60ff7890f207","AD Attribute" +"msDS-cloudExtensionAttribute8","3cd1c514-8449-44ca-81c0-021781800d2a","AD Attribute" +"msDS-cloudExtensionAttribute9","0a63e12c-3040-4441-ae26-cd95af0d247e","AD Attribute" +"msDS-cloudExtensionAttribute10","670afcb3-13bd-47fc-90b3-0a527ed81ab7","AD Attribute" +"msDS-cloudExtensionAttribute11","9e9ebbc8-7da5-42a6-8925-244e12a56e24","AD Attribute" +"msDS-cloudExtensionAttribute12","3c01c43d-e10b-4fca-92b2-4cf615d5b09a","AD Attribute" +"msDS-cloudExtensionAttribute13","28be464b-ab90-4b79-a6b0-df437431d036","AD Attribute" +"msDS-cloudExtensionAttribute14","cebcb6ba-6e80-4927-8560-98feca086a9f","AD Attribute" +"msDS-cloudExtensionAttribute15","aae4d537-8af0-4daa-9cc6-62eadb84ff03","AD Attribute" +"msDS-cloudExtensionAttribute16","9581215b-5196-4053-a11e-6ffcafc62c4d","AD Attribute" +"msDS-cloudExtensionAttribute17","3d3c6dda-6be8-4229-967e-2ff5bb93b4ce","AD Attribute" +"msDS-cloudExtensionAttribute18","88e73b34-0aa6-4469-9842-6eb01b32a5b5","AD Attribute" +"msDS-cloudExtensionAttribute19","0975fe99-9607-468a-8e18-c800d3387395","AD Attribute" +"msDS-cloudExtensionAttribute20","f5446328-8b6e-498d-95a8-211748d5acdc","AD Attribute" +"msDS-IssuerCertificates","6b3d6fda-0893-43c4-89fb-1fb52a6616a9","AD Attribute" +"msDS-RegistrationQuota","ca3286c2-1f64-4079-96bc-e62b610e730f","AD Attribute" +"msDS-MaximumRegistrationInactivityPeriod","0a5caa39-05e6-49ca-b808-025b936610e7","AD Attribute" +"msDS-DeviceLocation","e3fb56c8-5de8-45f5-b1b1-d2b6cd31e762","AD Attribute" +"msDS-RegisteredOwner","617626e9-01eb-42cf-991f-ce617982237e","AD Attribute" +"msDS-RegisteredUsers","0449160c-5a8e-4fc8-b052-01c0f6e48f02","AD Attribute" +"msDS-ApproximateLastLogonTimeStamp","a34f983b-84c6-4f0c-9050-a3a14a1d35a4","AD Attribute" +"msDS-IsEnabled","22a95c0e-1f83-4c82-94ce-bea688cfc871","AD Attribute" +"msDS-DeviceOSType","100e454d-f3bb-4dcb-845f-8d5edc471c59","AD Attribute" +"msDS-DeviceOSVersion","70fb8c63-5fab-4504-ab9d-14b329a8a7f8","AD Attribute" +"msDS-DevicePhysicalIDs","90615414-a2a0-4447-a993-53409599b74e","AD Attribute" +"msDS-DeviceID","c30181c7-6342-41fb-b279-f7c566cbe0a7","AD Attribute" +"msDS-DeviceObjectVersion","ef65695a-f179-4e6a-93de-b01e06681cfb","AD Attribute" +"msds-memberOfTransitive","862166b6-c941-4727-9565-48bfff2941de","AD Attribute" +"msds-memberTransitive","e215395b-9104-44d9-b894-399ec9e21dfc","AD Attribute" +"msDS-parentdistname","b918fe7d-971a-f404-9e21-9261abec970b","AD Attribute" +"msDS-ReplValueMetaDataExt","1e02d2ef-44ad-46b2-a67d-9fd18d780bca","AD Attribute" +"msDS-DrsFarmID","6055f766-202e-49cd-a8be-e52bb159edfb","AD Attribute" +"msDS-IssuerPublicCertificates","b5f1edfe-b4d2-4076-ab0f-6148342b0bf6","AD Attribute" +"msDS-IsManaged","60686ace-6c27-43de-a4e5-f00c2f8d3309","AD Attribute" +"msDS-CloudIsManaged","5315ba8e-958f-4b52-bd38-1349a304dd63","AD Attribute" +"msDS-CloudAnchor","78565e80-03d4-4fe3-afac-8c3bca2f3653","AD Attribute" +"msDS-CloudIssuerPublicCertificates","a1e8b54f-4bd6-4fd2-98e2-bcee92a55497","AD Attribute" +"msDS-CloudIsEnabled","89848328-7c4e-4f6f-a013-28ce3ad282dc","AD Attribute" +"msDS-SyncServerUrl","b7acc3d2-2a74-4fa4-ac25-e63fe8b61218","AD Attribute" +"msDS-UserAllowedToAuthenticateTo","de0caa7f-724e-4286-b179-192671efc664","AD Attribute" +"msDS-UserAllowedToAuthenticateFrom","2c4c9600-b0e1-447d-8dda-74902257bdb5","AD Attribute" +"msDS-UserTGTLifetime","8521c983-f599-420f-b9ab-b1222bdf95c1","AD Attribute" +"msDS-ComputerAllowedToAuthenticateTo","105babe9-077e-4793-b974-ef0410b62573","AD Attribute" +"msDS-ComputerTGTLifetime","2e937524-dfb9-4cac-a436-a5b7da64fd66","AD Attribute" +"msDS-ServiceAllowedToAuthenticateTo","f2973131-9b4d-4820-b4de-0474ef3b849f","AD Attribute" +"msDS-ServiceAllowedToAuthenticateFrom","97da709a-3716-4966-b1d1-838ba53c3d89","AD Attribute" +"msDS-ServiceTGTLifetime","5dfe3c20-ca29-407d-9bab-8421e55eb75c","AD Attribute" +"msDS-AssignedAuthNPolicySilo","b23fc141-0df5-4aea-b33d-6cf493077b3f","AD Attribute" +"msDS-AssignedAuthNPolicySiloBL","33140514-f57a-47d2-8ec4-04c4666600c7","AD Attribute" +"msDS-AuthNPolicySiloMembers","164d1e05-48a6-4886-a8e9-77a2006e3c77","AD Attribute" +"msDS-AuthNPolicySiloMembersBL","11fccbc7-fbe4-4951-b4b7-addf6f9efd44","AD Attribute" +"msDS-UserAuthNPolicy","cd26b9f3-d415-442a-8f78-7c61523ee95b","AD Attribute" +"msDS-UserAuthNPolicyBL","2f17faa9-5d47-4b1f-977e-aa52fabe65c8","AD Attribute" +"msDS-ComputerAuthNPolicy","afb863c9-bea3-440f-a9f3-6153cc668929","AD Attribute" +"msDS-ComputerAuthNPolicyBL","2bef6232-30a1-457e-8604-7af6dbf131b8","AD Attribute" +"msDS-ServiceAuthNPolicy","2a6a6d95-28ce-49ee-bb24-6d1fc01e3111","AD Attribute" +"msDS-ServiceAuthNPolicyBL","2c1128ec-5aa2-42a3-b32d-f0979ca9fcd2","AD Attribute" +"msDS-AssignedAuthNPolicy","b87a0ad8-54f7-49c1-84a0-e64d12853588","AD Attribute" +"msDS-AssignedAuthNPolicyBL","2d131b3c-d39f-4aee-815e-8db4bc1ce7ac","AD Attribute" +"msDS-AuthNPolicyEnforced","7a560cc2-ec45-44ba-b2d7-21236ad59fd5","AD Attribute" +"msDS-AuthNPolicySiloEnforced","f2f51102-6be0-493d-8726-1546cdbc8771","AD Attribute" +"msDS-DeviceMDMStatus","f60a8f96-57c4-422c-a3ad-9e2fa09ce6f7","AD Attribute" +"msDS-ExternalDirectoryObjectId","bd29bf90-66ad-40e1-887b-10df070419a6","AD Attribute" +"msDS-IsCompliant","59527d0f-b7c0-4ce2-a1dd-71cef6963292","AD Attribute" +"msDS-KeyId","c294f84b-2fad-4b71-be4c-9fc5701f60ba","AD Attribute" +"msDS-KeyMaterial","a12e0e9f-dedb-4f31-8f21-1311b958182f","AD Attribute" +"msDS-KeyUsage","de71b44c-29ba-4597-9eca-c3348ace1917","AD Attribute" +"msDS-KeyPrincipal","bd61253b-9401-4139-a693-356fc400f3ea","AD Attribute" +"msDS-KeyPrincipalBL","d1328fbc-8574-4150-881d-0b1088827878","AD Attribute" +"msDS-DeviceDN","642c1129-3899-4721-8e21-4839e3988ce5","AD Attribute" +"msDS-ComputerSID","dffbd720-0872-402e-9940-fcd78db049ba","AD Attribute" +"msDS-CustomKeyInformation","b6e5e988-e5e4-4c86-a2ae-0dacb970a0e1","AD Attribute" +"msDS-KeyApproximateLastLogonTimeStamp","649ac98d-9b9a-4d41-af6b-f616f2a62e4a","AD Attribute" +"msDS-DeviceTrustType","c4a46807-6adc-4bbb-97de-6bed181a1bfe","AD Attribute" +"msDS-ShadowPrincipalSid","1dcc0722-aab0-4fef-956f-276fe19de107","AD Attribute" +"msDS-KeyCredentialLink","5b47d60f-6090-40b2-9f37-2a4de88f3063","AD Attribute" +"msDS-KeyCredentialLink-BL","938ad788-225f-4eee-93b9-ad24a159e1db","AD Attribute" +"msDS-ExpirePasswordsOnSmartCardOnlyAccounts","3417ab48-df24-4fb1-80b0-0fcb367e25e3","AD Attribute" +"msDS-UserAllowedNTLMNetworkAuthentication","7ece040f-9327-4cdc-aad3-037adfe62639","AD Attribute" +"msDS-ServiceAllowedNTLMNetworkAuthentication","278947b9-5222-435e-96b7-1503858c2b48","AD Attribute" +"msDS-StrongNTLMPolicy","aacd2170-482a-44c6-b66e-42c2f66a285c","AD Attribute" +"msDS-SourceAnchor","b002f407-1340-41eb-bca0-bd7d938e25a9","AD Attribute" +"msDS-ObjectSoa","34f6bdf5-2e79-4c3b-8e14-3d93b75aab89","AD Attribute" +addressBookRoots2,"508ca374-a511-4e4e-9f4f-856f61a6b7e4","AD Attribute" +globalAddressList2,"4898f63d-4112-477c-8826-3ca00bd8277d","AD Attribute" +templateRoots2,"b1cba91a-0682-4362-a659-153e201ef069","AD Attribute" +"ms-Mcs-AdmPwdExpirationTime","b6b11ea3-6db4-4bae-8a4b-94a54250c869","AD Attribute" +"ms-Mcs-AdmPwd","71f6c31d-531d-4c45-828e-db6cdab302c8","AD Attribute" +Applications,"{F9C77450-3A41-477E-9310-9ACD617BD9E3}","CSE GUID" +"Data Sources","{728EE579-943C-4519-9EF7-AB56765798ED}","CSE GUID" +Devices,"{1A6364EB-776B-4120-ADE1-B63A406A76B5}","CSE GUID" +Drives,"{5794DAFD-BE60-433F-88A2-1A31939AC01F}","CSE GUID" +"Environment Variables","{0E28E245-9368-4853-AD84-6DA3BA35BB75}","CSE GUID" +Files,"{7150F9BF-48AD-4DA4-A49C-29EF4A8369BA}","CSE GUID" +"Folder Options","{A3F3E39B-5D83-4940-B954-28315B82F0A8}","CSE GUID" +Folders,"{6232C319-91AC-4931-9385-E70C2B099F0E}","CSE GUID" +"Ini Files","{74EE6C03-5363-4554-B161-627540339CAB}","CSE GUID" +"Internet Settings","{E47248BA-94CC-49C4-BBB5-9EB7F05183D0}","CSE GUID" +"Local users and groups","{17D89FEC-5C44-4972-B12D-241CAEF74509}","CSE GUID" +"Network Options","{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}","CSE GUID" +"Network Shares","{6A4C88C6-C502-4F74-8F60-2CB23EDC24E2}","CSE GUID" +"Power Options","{E62688F0-25FD-4C90-BFF5-F508B9D2E31F}","CSE GUID" +Printers,"{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}","CSE GUID" +"Regional Options","{E5094040-C46C-4115-B030-04FB2E545B00}","CSE GUID" +Registry,"{B087BE9D-ED37-454F-AF9C-04291E351182}","CSE GUID" +ScheduledTasks,"{AADCED64-746C-4633-A97C-D61349046527}","CSE GUID" +Services,"{91FBB303-0CD5-4055-BF42-E512A681B325}","CSE GUID" +Shortcuts,"{C418DD9D-0D14-4EFB-8FBF-CFE535C8FAC7}","CSE GUID" +"Start Menu","{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}","CSE GUID" +Scripts,"{42B5FAAE-6536-11D2-AE5A-0000F87571E3}","CSE GUID" +Registry,"{35378EAC-683F-11D2-A89A-00C04FBBCFA2}","CSE GUID" +Applications,"{0DA274B5-EB93-47A7-AAFB-65BA532D3FE6}","Tool extension GUID" +"Data Sources","{1612B55C-243C-48DD-A449-FFC097B19776}","Tool extension GUID" +Devices,"{1B767E9A-7BE4-4D35-85C1-2E174A7BA951}","Tool extension GUID" +Drives,"{2EA1A81B-48E5-45E9-8BB7-A6E3AC170006}","Tool extension GUID" +"Environment Variables","{35141B6B-498A-4CC7-AD59-CEF93D89B2CE}","Tool extension GUID" +Files,"{3BAE7E51-E3F4-41D0-853D-9BB9FD47605F}","Tool extension GUID" +"Folder Options","{3BFAE46A-7F3A-467B-8CEA-6AA34DC71F53}","Tool extension GUID" +Folders,"{3EC4E9D3-714D-471F-88DC-4DD4471AAB47}","Tool extension GUID" +"Ini Files","{516FC620-5D34-4B08-8165-6A06B623EDEB}","Tool extension GUID" +"Internet Settings","{5C935941-A954-4F7C-B507-885941ECE5C4}","Tool extension GUID" +"Local users and groups","{79F92669-4224-476C-9C5C-6EFB4D87DF4A}","Tool extension GUID" +"Network Options","{949FB894-E883-42C6-88C1-29169720E8CA}","Tool extension GUID" +"Network Shares","{BFCBBEB0-9DF4-4C0C-A728-434EA66A0373}","Tool extension GUID" +"Power Options","{9AD2BAFE-63B4-4883-A08C-C3C6196BCAFD}","Tool extension GUID" +Printers,"{A8C42CEA-CDB8-4388-97F4-5831F933DA84}","Tool extension GUID" +"Regional Options","{B9CCA4DE-E2B9-4CBD-BF7D-11B6EBFBDDF7}","Tool extension GUID" +Registry,"{BEE07A6A-EC9F-4659-B8C9-0B1937907C83}","Tool extension GUID" +ScheduledTasks,"{CAB54552-DEEA-4691-817E-ED4A4D1AFC72}","Tool extension GUID" +Services,"{CC5746A9-9B74-4BE5-AE2E-64379C86E0E4}","Tool extension GUID" +Shortcuts,"{CEFFA6E2-E3BD-421B-852C-6F6A79A59BC1}","Tool extension GUID" +"Start Menu","{CF848D48-888D-4F45-B530-6A201E62A605}","Tool extension GUID" +Scripts,"{40B6664F-4972-11D1-A7CA-0000F87571E3}","Tool extension GUID" +Registry,"{D02B1F72-3407-48AE-BA88-E8213C6761F1}","Tool extension GUID" +"Computer Policy Settings","{0F6B957D-509E-11D1-A7CC-0000F87571E3}","CSE GUID / Tool extension GUID" +"User Policy Settings - Restrict Run","{0F6B957E-509E-11D1-A7CC-0000F87571E3}","CSE GUID / Tool extension GUID" +"Data Sources","{1612B55C-243C-48DD-A449-FFC097B19776}","CSE GUID / Tool extension GUID" +Devices,"{1B767E9A-7BE4-4D35-85C1-2E174A7BA951}","CSE GUID / Tool extension GUID" +"Folder Redirection","{25537BA6-77A8-11D2-9B6C-0000F8080861}","CSE GUID / Tool extension GUID" +"Remote Installation Services","{3060E8CE-7020-11D2-842D-00C04FA372D4}","CSE GUID / Tool extension GUID" +"Registry Settings","{35378EAC-683F-11D2-A89A-00C04FBBCFA2","CSE GUID / Tool extension GUID" +"Microsoft Disk Quota","{3610EDA5-77EF-11D2-8DC5-00C04FA31A66}","CSE GUID / Tool extension GUID" +"Scripts (Logon/Logoff) Run Restriction","{40B66650-4972-11D1-A7CA-0000F87571E3}","CSE GUID / Tool extension GUID" +ProcessScriptsGroupPolicy,"{42B5FAAE-6536-11D2-AE5A-0000F87571E3}","CSE GUID / Tool extension GUID" +"Print Policy in PolicyMaker","{47BA4403-1AA0-47F6-BDC5-298F96D1C2E3}","CSE GUID / Tool extension GUID" +"Internet Explorer Zonemapping","{4CFB60C1-FAA6-47F1-89AA-0B18730C9FD3}","CSE GUID / Tool extension GUID" +"Certificates Run Restriction","{53D6AB1D-2488-11D1-A28C-00C04FB94F17}","CSE GUID / Tool extension GUID" +Drives,"{5794DAFD-BE60-433F-88A2-1A31939AC01F}","CSE GUID / Tool extension GUID" +"Network Shares","{6A4C88C6-C502-4F74-8F60-2CB23EDC24E2}","CSE GUID / Tool extension GUID" +Files,"{7150F9BF-48AD-4DA4-A49C-29EF4A8369BA}","CSE GUID / Tool extension GUID" +"Local users and groups","{79F92669-4224-476C-9C5C-6EFB4D87DF4A}","CSE GUID / Tool extension GUID" +"Internet Explorer User Accelerators/PolicyMaker","{7B849A69-220F-451E-B3FE-2CB811AF94AE}","CSE GUID / Tool extension GUID" +"Computer Restricted Groups","{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}","CSE GUID / Tool extension GUID" +Security,"{827D319E-6EAC-11D2-A4EA-00C04F79F83A}","CSE GUID / Tool extension GUID" +"Folder Redirection","{88E729D6-BDC1-11D1-BD2A-00C04FB9603F}","CSE GUID / Tool extension GUID" +"Deployed Printer Connections","{8A28E2C5-8D06-49A4-A08C-632DAA493E17}","CSE GUID / Tool extension GUID" +"Software Installation (Computers).","{942A8E4F-A261-11D1-A760-00C04FB9603F}","CSE GUID / Tool extension GUID" +"Internet Explorer Maintenance policy processing","{A2E30F80-D7DE-11D2-BBDE-00C04F86AE3B]","CSE GUID / Tool extension GUID" +Registry,"{B087BE9D-ED37-454F-AF9C-04291E351182}","CSE GUID / Tool extension GUID" +"EFS Recovery","{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A]","CSE GUID / Tool extension GUID" +"802.3 Group Policy","{B587E2B1-4D59-4E7E-AED9-22B9DF11D053}","CSE GUID / Tool extension GUID" +"Software Installation (Users) Run Restriction","{BACF5C8A-A3C7-11D1-A760-00C04FB9603F}","CSE GUID / Tool extension GUID" +"Network Shares","{BFCBBEB0-9DF4-4C0C-A728-434EA66A0373}","CSE GUID / Tool extension GUID" +Shortcuts,"{C418DD9D-0D14-4EFB-8FBF-CFE535C8FAC7}","CSE GUID / Tool extension GUID" +"Microsoft Offline Files","{C631DF4C-088F-4156-B058-4375F0853CD8}","CSE GUID / Tool extension GUID" +"Application Management","{C6DC5466-785A-11D2-84D0-00C04FB169F7]","CSE GUID / Tool extension GUID" +Services,"{CC5746A9-9B74-4BE5-AE2E-64379C86E0E4}","CSE GUID / Tool extension GUID" +"User Policy Settings","{D02B1F73-3407-48AE-BA88-E8213C6761F1}","CSE GUID / Tool extension GUID" +"Power Options","{E62688F0-25FD-4C90-BFF5-F508B9D2E31F}","CSE GUID / Tool extension GUID" +"Policy Maker","{F0DB2806-FD46-45B7-81BD-AA3744B32765}","CSE GUID / Tool extension GUID" +"Policy Maker","{F17E8B5B-78F2-49A6-8933-7B767EDA5B41}","CSE GUID / Tool extension GUID" +"Policy Maker","{F27A6DA8-D22B-4179-A042-3D715F9E75B5}","CSE GUID / Tool extension GUID" +"Policy Maker","{F581DAE7-8064-444A-AEB3-1875662A61CE}","CSE GUID / Tool extension GUID" +"Policy Maker","{F648C781-42C9-4ED4-BB24-AEB8853701D0}","CSE GUID / Tool extension GUID" +"Policy Maker","{F6E72D5A-6ED3-43D9-9710-4440455F6934}","CSE GUID / Tool extension GUID" +"Enterprise QoS","{FB2CA36D-0B40-4307-821B-A13B252DE56C}","CSE GUID / Tool extension GUID" +"Internet Explorer Maintenance Extension protocol","{FC715823-C5FB-11D1-9EEF-00A0C90347FF}","CSE GUID / Tool extension GUID" +"Policy Maker","{FD2D917B-6519-4BF7-8403-456C0C64312F}","CSE GUID / Tool extension GUID" +"Policy Maker","{FFC64763-70D2-45BC-8DEE-7ACAF1BA7F89}","CSE GUID / Tool extension GUID" +TCPIP,"{CDEAFC3D-948D-49DD-AB12-E578BA4AF7AA}","CSE GUID / Tool extension GUID" +"IP Security","{E437BC1C-AA7D-11D2-A382-00C04F991E27]","CSE GUID / Tool extension GUID" +"Audit Policy Configuration","{F3CCC681-B74C-4060-9F26-CD84525DCA2A}","CSE GUID / Tool extension GUID" +"Windows Firewall","{B05566AC-FE9C-4368-BE01-7A4CBB6CBA11}","CSE GUID / Tool extension GUID" +"Software Installation","{C6DC5466-785A-11D2-84D0-00C04FB169F7}","CSE GUID / Tool extension GUID" \ No newline at end of file diff --git a/lookups/msad_guid_lookup.yml b/lookups/msad_guid_lookup.yml new file mode 100644 index 0000000000..b036f88e84 --- /dev/null +++ b/lookups/msad_guid_lookup.yml @@ -0,0 +1,3 @@ +description: A lookup file that will contain translations for AD object ace control access rights guids +filename: msad_guid_lookup.csv +name: msad_guid_lookup \ No newline at end of file From 331d9921142bb425975b849b1808cc4162eebef1 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Tue, 2 Jul 2024 11:56:06 +1000 Subject: [PATCH 02/15] adding AD ACL and GPO related detections --- lookups/ace_flag_lookup.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lookups/ace_flag_lookup.yml b/lookups/ace_flag_lookup.yml index 90a0cacef1..04c9c22d75 100644 --- a/lookups/ace_flag_lookup.yml +++ b/lookups/ace_flag_lookup.yml @@ -1,3 +1,3 @@ description: A lookup file that will contain translations for AD object ace flags strings filename: ace_flag_lookup.csv -name: ace_flag_lookup.yml \ No newline at end of file +name: ace_flag_lookup \ No newline at end of file From 62565d205c85559afdce1003b81813bc6c0a6b1a Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Tue, 2 Jul 2024 12:35:23 +1000 Subject: [PATCH 03/15] Revert "Adding new detections" This reverts commit a10332f69a766cf4f514d3d480185c5a5a38c6db. --- .../detect_password_spray_attempts.yml | 67 ------------------- .../windows_ad_add_self_to_group.yml | 51 -------------- ..._group_or_object_modification_activity.yml | 52 -------------- ...increase_in_user_modification_activity.yml | 53 --------------- ...ndows_network_share_discovery_with_net.yml | 59 ---------------- .../windows_vulnerable_driver_installed.yml | 0 .../network/internal_horizontal_port_scan.yml | 57 ---------------- .../network/internal_vertical_port_scan.yml | 0 .../network/internal_vulnerability_scan.yml | 56 ---------------- 9 files changed, 395 deletions(-) delete mode 100644 detections/application/detect_password_spray_attempts.yml delete mode 100644 detections/application/windows_ad_add_self_to_group.yml delete mode 100644 detections/application/windows_increase_in_group_or_object_modification_activity.yml delete mode 100644 detections/application/windows_increase_in_user_modification_activity.yml delete mode 100644 detections/endpoint/windows_network_share_discovery_with_net.yml delete mode 100644 detections/endpoint/windows_vulnerable_driver_installed.yml delete mode 100644 detections/network/internal_horizontal_port_scan.yml delete mode 100644 detections/network/internal_vertical_port_scan.yml delete mode 100644 detections/network/internal_vulnerability_scan.yml diff --git a/detections/application/detect_password_spray_attempts.yml b/detections/application/detect_password_spray_attempts.yml deleted file mode 100644 index 9c0ea37da0..0000000000 --- a/detections/application/detect_password_spray_attempts.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Detect Password Spray Attempts -id: 086ab581-8877-42b3-9aee-4a7ecb0923af -version: 1 -date: '2023-11-01' -author: Dean Luxton -status: production -type: TTP -data_source: -- Authentication Datamodel -description: This analytic uses the 3-sigma approach to detect an unusual volume of failed authentication from a single source. Utilising the authentication datamodel this detection is affective for all CIM mapped authication events. -search: '| tstats `security_content_summariesonly` dc(Authentication.user) AS unique_accounts values(Authentication.app) as app count(Authentication.user) as total_failures from datamodel=Authentication.Authentication where Authentication.action="failure" by Authentication.src, Authentication.action, Authentication.signature_id, sourcetype, _time span=2m - | `drop_dm_object_name("Authentication")` - ```fill out time buckets for 0-count events during entire search length``` - | appendpipe [| timechart limit=0 span=5m count | table _time] - | fillnull value=0 unique_accounts, unique_src - ``` remove duplicate & empty time buckets``` - | sort - total_failures - | dedup _time - ``` Create aggregation field & apply to all null events``` - | eval counter=src+"__"+sourcetype+"__"+signature_id - | eventstats values(counter) as fnscounter | eval counter=coalesce(counter,fnscounter) - | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by counter - | eval upperBound=(comp_avg+comp_std*3) - | eval isOutlier=if(unique_accounts > 30 and unique_accounts >= upperBound, 1, 0) - | replace "::ffff:*" with * in src - | where isOutlier=1 - | foreach * [ eval <> = if(<>="null",null(),<>)] - | table _time, src, action, app, unique_accounts, total_failures, sourcetype, signature_id - | `detect_password_spray_attempts_filter`' -how_to_implement: Ensure in-scope authentication data is CIM mapped and the src field is populated with the source device. Also ensure fill_nullvalue is set within the macro security_content_summariesonly. -known_false_positives: Unknown -references: -- https://attack.mitre.org/techniques/T1110/003/ -tags: - analytic_story: - - Compromised User Account - - Active Directory Password Spraying - asset_type: Endpoint - atomic_guid: - - 90bc2e54-6c84-47a5-9439-0a2a92b4b175 - confidence: 70 - impact: 70 - message: Potential Password Spraying attack from $src$ targeting $unique_accounts$ unique accounts. - mitre_attack_id: - - T1110.003 - - T1110 - observable: - - name: src - type: Endpoint - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - required_fields: - - Authentication.action - - Authentication.user - - Authentication.src - security_domain: access -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/detections/application/windows_ad_add_self_to_group.yml b/detections/application/windows_ad_add_self_to_group.yml deleted file mode 100644 index b0caa2160d..0000000000 --- a/detections/application/windows_ad_add_self_to_group.yml +++ /dev/null @@ -1,51 +0,0 @@ -name: Windows AD add Self to Group -id: 065f2701-b7ea-42f5-9ec4-fbc2261165f9 -version: 1 -date: '2023-12-18' -author: Dean Luxton -status: production -type: TTP -data_source: -- Windows Event Log Security 4728 -description: Detect when a user adds themselfs to an AD Group. -search: '`wineventlog_security` EventCode IN (4728) - | where user=src_user - | stats min(_time) as _time dc(user) as usercount, values(user) as user values(user_category) as user_category values(src_user_category) as src_user_category values(dvc) as dvc by signature, Group_Name, src_user - | `windows_ad_add_self_to_group_filter`' -how_to_implement: This analytic requires eventCode 4728 to be ingested. -known_false_positives: Unknown -references: [] -tags: - analytic_story: - - Active Directory Privilege Escalation - - Sneaky Active Directory Persistence Tricks - asset_type: Endpoint - confidence: 100 - impact: 50 - message: $user$ added themselves to AD Group $Group_Name$ - mitre_attack_id: - - T1098 - observable: - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 50 - required_fields: - - EventCode - - user - - src_user - - signature - - Group_Name - security_domain: audit -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog - update_timestamp: true \ No newline at end of file diff --git a/detections/application/windows_increase_in_group_or_object_modification_activity.yml b/detections/application/windows_increase_in_group_or_object_modification_activity.yml deleted file mode 100644 index 1fdbd7f382..0000000000 --- a/detections/application/windows_increase_in_group_or_object_modification_activity.yml +++ /dev/null @@ -1,52 +0,0 @@ -name: Windows Increase in Group or Object Modification Activity -id: 4f9564dd-a204-4f22-b375-4dfca3a68731 -version: 1 -date: '2023-10-13' -author: Dean Luxton -status: production -type: TTP -data_source: -- XmlWinEventLog:Security -description: Increase in group or AD object modifications. -search: >- - `wineventlog_security` EventCode IN (4670,4727,4731,4734,4735,4764) - | bucket span=5m _time - | stats values(object) as object, dc(object) as objectCount, values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category) as dest_category by _time, src_user, signature, status - | eventstats avg(objectCount) as comp_avg, stdev(objectCount) as comp_std by src_user, signature - | eval upperBound=(comp_avg+comp_std) - | eval isOutlier=if(objectCount > 10 and (objectCount >= upperBound), 1, 0) - | search isOutlier=1 - | `windows_increase_in_group_or_object_modification_activity_filter` -how_to_implement: Run over past 7 days for best results. -known_false_positives: Unknown -references: [] -tags: - analytic_story: - - Sneaky Active Directory Persistence Tricks - asset_type: Endpoint - confidence: 40 - impact: 20 - message: Spike in Group or Object Modifications performed by $src_user$ - mitre_attack_id: - - T1098 - observable: - - name: src_user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 8 - required_fields: - - EventCode - - src_user - - signature - security_domain: audit -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/detections/application/windows_increase_in_user_modification_activity.yml b/detections/application/windows_increase_in_user_modification_activity.yml deleted file mode 100644 index cb8e263e59..0000000000 --- a/detections/application/windows_increase_in_user_modification_activity.yml +++ /dev/null @@ -1,53 +0,0 @@ -name: Windows Increase in User Modification Activity -id: 0995fca1-f346-432f-b0bf-a66d14e6b428 -version: 1 -date: '2023-10-13' -author: Dean Luxton -status: production -type: TTP -data_source: -- XmlWinEventLog:Security -description: Increase in user account modifications. -search: >- - `wineventlog_security` EventCode IN (4720,4722,4723,4724,4725,4726,4728,4732,4733,4738,4743,4780) - | bucket span=5m _time - | stats values(TargetDomainName) as TargetDomainName, values(user) as user, dc(user) as userCount, values(user_category) as user_category, values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category) as dest_category by _time, src_user, signature, status - | eventstats avg(userCount) as comp_avg , stdev(userCount) as comp_std by src_user, signature - | eval upperBound=(comp_avg+comp_std*3) - | eval isOutlier=if(userCount > 10 and userCount >= upperBound, 1, 0) - | search isOutlier=1 - | stats values(TargetDomainName) as TargetDomainName, values(user) as user, dc(user) as userCount, values(user_category) as user_category, values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category) as dest_category values(signature) as signature by _time, src_user, status - | `windows_increase_in_user_modification_activity_filter` -how_to_implement: Run over past 7 days for best results. -known_false_positives: Genuine activity -references: [] -tags: - analytic_story: - - Sneaky Active Directory Persistence Tricks - asset_type: Endpoint - confidence: 40 - impact: 20 - message: Spike in User Modification actions performed by $src_user$ - mitre_attack_id: - - T1098 - observable: - - name: src_user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 8 - required_fields: - - EventCode - - src_user - - signature - security_domain: audit -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/detections/endpoint/windows_network_share_discovery_with_net.yml b/detections/endpoint/windows_network_share_discovery_with_net.yml deleted file mode 100644 index 950f1a390d..0000000000 --- a/detections/endpoint/windows_network_share_discovery_with_net.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Windows Network Share Discovery With Net -id: 4dc3951f-b3f8-4f46-b412-76a483f72277 -version: 1 -date: '2023-04-21' -author: Dean Luxton -status: production -type: TTP -data_source: -- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/net_share/windows-sysmon.log -description: Network share discovery performed on Windows using the Net Command. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.user_category) as user_category values(Processes.user_bunit) as user_bunit FROM datamodel=Endpoint.Processes WHERE ((Processes.process_name="net.exe" OR Processes.orig_process_name="net.exe") AND (Processes.process="*net*view*" OR Processes.process="*net*share*")) BY Processes.user Processes.dest Processes.process_exec Processes.parent_process_exec - Processes.process Processes.parent_process - | `drop_dm_object_name(Processes)` - | regex process="net\s+view|net\s+share" - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_network_share_discovery_with_net_filter`' -how_to_implement: Ensure you are populating the endpoint datamodel. -known_false_positives: Unknown -references: -- https://attack.mitre.org/techniques/T1135/ -tags: - analytic_story: - - Active Directory Discovery - - Active Directory Privilege Escalation - - Network Discovery - asset_type: Endpoint - atomic_guid: - - ab39a04f-0c93-4540-9ff2-83f862c385ae - confidence: 100 - impact: 20 - message: Network share enumeration performed on $dest$ by $user$, executed by parent process $parent_process$ - mitre_attack_id: - - T1135 - required_fields: - - Processes.process_name - - Processes.user - - Processes.dest - - Processes.process_exec - - Processes.parent_process_exec - - Processes.process - - Processes.parent_process - observable: - - name: dest - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 20 - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/net_share/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/endpoint/windows_vulnerable_driver_installed.yml b/detections/endpoint/windows_vulnerable_driver_installed.yml deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/detections/network/internal_horizontal_port_scan.yml b/detections/network/internal_horizontal_port_scan.yml deleted file mode 100644 index 505571fcfd..0000000000 --- a/detections/network/internal_horizontal_port_scan.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Internal Horizontal Port Scan -id: 1ff9eb9a-7d72-4993-a55e-59a839e607f1 -version: 1 -date: '2023-10-20' -author: Dean Luxton -status: production -type: TTP -data_source: [] -description: This analytic detects where an internal host has attempted to communicate with 250 or more destination IP addresses using the same port / protocol. -search: '| tstats `security_content_summariesonly` values(All_Traffic.action) as action - values(All_Traffic.src_category) as src_category values(All_Traffic.dest_zone) as - dest_zone values(All_Traffic.src_zone) as src_zone count from datamodel=Network_Traffic - where All_Traffic.src_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16") by All_Traffic.src_ip All_Traffic.dest_port - All_Traffic.dest_ip span=1s _time All_Traffic.transport | `drop_dm_object_name("All_Traffic")` - | eval gtime=_time | bin span=1h gtime | stats min(_time) as _time values(action) - as action dc(dest_ip) as totalDestIPCount values(src_category) as src_category values(dest_zone) - as dest_zone values(src_zone) as src_zone by src_ip dest_port gtime transport | - where totalDestIPCount>=250 | eval dest_port=transport + "/" + dest_port | stats - min(_time) as _time values(action) as action sum(totalDestIPCount) as totalDestIPCount - values(src_category) as src_category values(dest_port) as dest_ports values(dest_zone) - as dest_zone values(src_zone) as src_zone by src_ip gtime | fields - gtime | `internal_horizontal_port_scan_filter`' -how_to_implement: Ensure your network traffic data is populating the Network_Traffic data model. -known_false_positives: Unknown -references: [] -tags: - analytic_story: - - Network Discovery - asset_type: Endpoint - confidence: 80 - impact: 80 - message: $src_ip$ has scanned for port $dest_port$ across $totalDestIPCount$ destination IPs - mitre_attack_id: - - T1046 - observable: - - name: src_ip - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - required_fields: - - _time - - All_Traffic.action - - All_Traffic.src_ip - - All_Traffic.dest_ip - - All_Traffic.dest_port - security_domain: network -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1046/nmap/horizontal.log - source: aws:cloudwatchlogs:vpcflow - sourcetype: aws:cloudwatchlogs:vpcflow - update_timestamp: true \ No newline at end of file diff --git a/detections/network/internal_vertical_port_scan.yml b/detections/network/internal_vertical_port_scan.yml deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/detections/network/internal_vulnerability_scan.yml b/detections/network/internal_vulnerability_scan.yml deleted file mode 100644 index 2f2dab7164..0000000000 --- a/detections/network/internal_vulnerability_scan.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: Internal Vulnerability Scan -id: 46f946ed-1c78-4e96-9906-c7a4be15e39b -version: 1 -date: '2023-10-27' -author: Dean Luxton -status: experimental -type: TTP -data_source: [] -description: This analytic detects internal hosts triggering multiple IDS signatures (either more than 25 signatures against a single host, or a single signature across over 25 destinations), which can be indicative of active vulnerability scanning performed within the network. -search: '| tstats `security_content_summariesonly` values(IDS_Attacks.action) as action - values(IDS_Attacks.src_category) as src_category values(IDS_Attacks.dest_category) - as dest_category count from datamodel=Intrusion_Detection.IDS_Attacks where IDS_Attacks.src - IN (10.0.0.0/8,192.168.0.0/16,172.16.0.0/12) IDS_Attacks.severity IN (critical, - high, medium) by IDS_Attacks.src IDS_Attacks.severity IDS_Attacks.signature IDS_Attacks.dest - IDS_Attacks.dest_port IDS_Attacks.transport span=1s _time | `drop_dm_object_name("IDS_Attacks")` - | eval gtime=_time | bin span=1h gtime | eventstats count as sevCount by severity - src | eventstats count as sigCount by signature src | eval severity=severity +"("+sevCount+")" - | eval signature=signature +"("+sigCount+")" | eval dest_port=transport + "/" + - dest_port | stats min(_time) as _time values(action) as action dc(dest) as destCount - dc(signature) as sigCount values(signature) values(src_category) as src_category - values(dest_category) as dest_category values(severity) as severity values(dest_port) - as dest_ports by src gtime | fields - gtime | where destCount>25 OR sigCount>25 - | `internal_vulnerability_scan_filter`' -how_to_implement: CIM mapped IDS/IPS logs are a required to drive this detection. -known_false_positives: Vulnerability Scanners and informational / low severity signatures. -references: [] -tags: - analytic_story: - - Network Discovery - asset_type: Endpoint - confidence: 80 - impact: 80 - message: Large volume of IDS signatures triggered by $src$ - mitre_attack_id: - - T1595.002 - - T1046 - observable: - - name: src - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 64 - required_fields: - - _time - - IDS_Attacks.action - - IDS_Attacks.src - - IDS_Attacks.dest - - IDS_Attacks.dest_port - - IDS_Attacks.severity - - IDS_Attacks.signature - - IDS_Attacks.transport - security_domain: network \ No newline at end of file From f98ae45f1c9e555a39d1e5fe040bc8b8497b101c Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Tue, 2 Jul 2024 12:36:08 +1000 Subject: [PATCH 04/15] Revert "Updating detections" This reverts commit 65e63e41937e5570647425fdfad69406cd57709f. --- ..._ad_global_administrator_role_assigned.yml | 19 ++++------ .../azure_ad_privileged_role_assigned.yml | 12 +++--- ...rvice_principal_new_client_credentials.yml | 34 +++++------------ .../detect_new_local_admin_account.yml | 17 +++------ ...on_flag_disabled_in_useraccountcontrol.yml | 13 +++---- ...tion_request_initiated_by_user_account.yml | 1 - ...t_initiated_from_unsanctioned_location.yml | 1 - ...n_default_group_policy_object_modified.yml | 14 +++---- ...dows_admon_group_policy_object_created.yml | 15 ++++---- lookups/privileged_azure_ad_roles.csv | 38 +++++++++---------- 10 files changed, 67 insertions(+), 97 deletions(-) diff --git a/detections/cloud/azure_ad_global_administrator_role_assigned.yml b/detections/cloud/azure_ad_global_administrator_role_assigned.yml index a97e7be545..b4acf713d2 100644 --- a/detections/cloud/azure_ad_global_administrator_role_assigned.yml +++ b/detections/cloud/azure_ad_global_administrator_role_assigned.yml @@ -1,8 +1,8 @@ name: Azure AD Global Administrator Role Assigned id: 825fed20-309d-4fd1-8aaf-cd49c1bb093c -version: 6 -date: '2024-07-02' -author: Gowthamaraj Rajendran, Mauricio Velazco, Dean Luxton, Splunk +version: 5 +date: '2024-05-29' +author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk status: production type: TTP description: The following analytic detects the assignment of the Azure AD Global @@ -15,14 +15,11 @@ description: The following analytic detects the assignment of the Azure AD Globa posing a severe security risk. data_source: - Azure Active Directory Add member to role -search: '`azure_monitor_aad` operationName="Add member to role" properties.targetResources{}.modifiedProperties{}.newValue="\"Global Administrator\"" - | rename properties.* as *, initiatedBy.user.userPrincipalName as userPrincipalName, targetResources{}.displayName as displayName - | eval initiatedBy = coalesce(userPrincipalName,src_user) - | eval user = coalesce(user,mvfilter(displayName!="null")) - | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user by initiatedBy, result, operationName - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `azure_ad_global_administrator_role_assigned_filter`' +search: '`azure_monitor_aad` operationName="Add member to role" properties.targetResources{}.modifiedProperties{}.newValue="\"Global + Administrator\"" | rename properties.* as * | rename initiatedBy.user.userPrincipalName + as initiatedBy | stats count min(_time) as firstTime max(_time) as lastTime values(user) + as user by initiatedBy, result, operationName | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `azure_ad_global_administrator_role_assigned_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment diff --git a/detections/cloud/azure_ad_privileged_role_assigned.yml b/detections/cloud/azure_ad_privileged_role_assigned.yml index 9d7a02ef8f..841b4c60f5 100644 --- a/detections/cloud/azure_ad_privileged_role_assigned.yml +++ b/detections/cloud/azure_ad_privileged_role_assigned.yml @@ -1,8 +1,8 @@ name: Azure AD Privileged Role Assigned id: a28f0bc3-3400-4a6e-a2da-89b9e95f0d2a -version: 4 -date: '2024-07-02' -author: Mauricio Velazco, Gowthamaraj Rajendran, Dean Luxton, Splunk +version: 3 +date: '2024-05-29' +author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production type: TTP description: The following analytic detects the assignment of privileged Azure Active @@ -14,10 +14,8 @@ description: The following analytic detects the assignment of privileged Azure A over the Azure AD infrastructure. data_source: - Azure Active Directory Add member to role -search: ' `azure_monitor_aad` "operationName"="Add member to role" - | rename properties.* as *, initiatedBy.user.userPrincipalName as userPrincipalName, targetResources{}.displayName as displayName - | eval initiatedBy = coalesce(userPrincipalName,src_user) - | eval user = coalesce(user,mvfilter(displayName!="null")) +search: ' `azure_monitor_aad` "operationName"="Add member to role" | rename properties.* as * + | rename initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.modifiedProperties{}.newValue as roles | eval role=mvindex(roles,1) | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user by initiatedBy, result, operationName, role diff --git a/detections/cloud/azure_ad_service_principal_new_client_credentials.yml b/detections/cloud/azure_ad_service_principal_new_client_credentials.yml index 6ba133cdc3..99e48bd36c 100644 --- a/detections/cloud/azure_ad_service_principal_new_client_credentials.yml +++ b/detections/cloud/azure_ad_service_principal_new_client_credentials.yml @@ -1,8 +1,8 @@ name: Azure AD Service Principal New Client Credentials id: e3adc0d3-9e4b-4b5d-b662-12cec1adff2a -version: 4 -date: '2024-07-02' -author: Mauricio Velazco, Gowthamaraj Rajendran, Dean Luxton, Splunk +version: 3 +date: '2024-05-11' +author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production type: TTP description: The following analytic detects the addition of new credentials to Service @@ -15,21 +15,11 @@ description: The following analytic detects the addition of new credentials to S access and control over the Azure environment. data_source: - Azure Active Directory -search: ' `azure_monitor_aad` category=AuditLogs operationName="Update application*Certificates and secrets management*" - | rename properties.* as * - | rename targetResources{}.* as * - | rename modifiedProperties{}.* as * - | eval src_user=coalesce(user,identity), newValue=mvfilter(newValue!="\"KeyDescription\"") - | stats count min(_time) as firstTime max(_time) as lastTime values(displayName) as displayName values(src_ip) as src_ip values(eval(mvfilter(oldValue!="null"))) as oldValue by src_user, object, newValue - | spath input=oldValue output=oldValues path={} - | spath input=newValue output=newValues path={} - | mvexpand newValues - | where NOT newValues IN (oldValues) - | fields - newValue, oldValue, oldValues - | rename newValues as newValue - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `azure_ad_service_principal_new_client_credentials_filter`' +search: ' `azure_monitor_aad` category=AuditLogs operationName="Update application*Certificates + and secrets management " | rename properties.* as * | rename targetResources{}.* + as * | stats count min(_time) as firstTime max(_time) as lastTime values(displayName) + as displayName by user, modifiedProperties{}.newValue, src_ip | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `azure_ad_service_principal_new_client_credentials_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. @@ -52,16 +42,12 @@ tags: asset_type: Azure Active Directory confidence: 50 impact: 70 - message: New Service Principal credentials were added to $object$ by $src_user$ + message: New credentials added for Service Principal by $user$ mitre_attack_id: - T1098 - T1098.001 observable: - - name: src_user - type: User - role: - - Victim - - name: object + - name: user type: User role: - Victim diff --git a/detections/endpoint/detect_new_local_admin_account.yml b/detections/endpoint/detect_new_local_admin_account.yml index 05c73d92fc..f85f0831f8 100644 --- a/detections/endpoint/detect_new_local_admin_account.yml +++ b/detections/endpoint/detect_new_local_admin_account.yml @@ -1,7 +1,7 @@ name: Detect New Local Admin account id: b25f6f62-0712-43c1-b203-083231ffd97d -version: 5 -date: '2024-07-02' +version: 4 +date: '2024-05-15' author: David Dorsey, Splunk status: production type: TTP @@ -10,11 +10,10 @@ description: |- data_source: - Windows Event Log Security 4732 - Windows Event Log Security 4720 -search: '`wineventlog_security` (EventCode=4720) OR (EventCode=4732 Group_Name=Administrators) -| stats dc(EventCode) as evCount min(_time) as _time range(_time) as duration values(src_user) as src_user values(src_user_category) as src_user_category values(dest_category) as dest_category by user dest -| where evCount=2 -| fields - evCount, duration -| `detect_new_local_admin_account_filter`' +search: '`wineventlog_security` EventCode=4720 OR (EventCode=4732 Group_Name=Administrators) + | transaction src_user connected=false maxspan=180m | rename src_user as user | + stats count min(_time) as firstTime max(_time) as lastTime by user dest | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `detect_new_local_admin_account_filter`' how_to_implement: You must be ingesting Windows event logs using the Splunk Windows TA and collecting event code 4720 and 4732 known_false_positives: The activity may be legitimate. For this reason, it's best @@ -40,10 +39,6 @@ tags: type: User role: - Victim - - name: src_user - type: User - role: - - Victim - name: dest type: Hostname role: diff --git a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml index 7b99ce810a..43385ce72c 100644 --- a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml +++ b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml @@ -1,8 +1,8 @@ name: Kerberos Pre-Authentication Flag Disabled in UserAccountControl id: 0cb847ee-9423-11ec-b2df-acde48001122 -version: 3 -date: '2024-07-02' -author: Mauricio Velazco, Dean Luxton, Splunk +version: 2 +date: '2024-05-24' +author: Mauricio Velazco, Splunk status: production type: TTP description: The following analytic detects when the Kerberos Pre-Authentication flag @@ -15,10 +15,9 @@ description: The following analytic detects when the Kerberos Pre-Authentication of sensitive information. data_source: - Windows Event Log Security 4738 -search: '`wineventlog_security` EventCode=4738 (UserAccountControl="%%2096" OR MSADChangedAttributes="*Don''t Require Preauth'' - Enabled*") - | eval MSADChangedAttributes="''Don''t Require Preauth'' - Enabled" - | table _time, source, EventCode, src_user, src_user_category, user, user_category, MSADChangedAttributes - | `kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter`' +search: ' `wineventlog_security` EventCode=4738 MSADChangedAttributes="*Don''t Require + Preauth'' - Enabled*" |rename Account_Name as user | table EventCode, user, dest, + Security_ID, MSADChangedAttributes | `kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `User Account Management` within `Account Management` needs to be enabled. diff --git a/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml b/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml index 3b998d3d3b..09293b4370 100644 --- a/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml +++ b/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml @@ -41,7 +41,6 @@ references: - https://adsecurity.org/?p=1729 - https://www.linkedin.com/pulse/mimikatz-dcsync-event-log-detections-john-dwyer - https://github.com/SigmaHQ/sigma/blob/0.22-699-g29a5c6278/rules/windows/builtin/security/win_security_dcsync.yml -- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory tags: analytic_story: - Sneaky Active Directory Persistence Tricks diff --git a/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml b/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml index 85d9731fbc..1b02916fdf 100644 --- a/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml +++ b/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml @@ -45,7 +45,6 @@ references: - https://adsecurity.org/?p=1729 - https://www.linkedin.com/pulse/mimikatz-dcsync-event-log-detections-john-dwyer - https://github.com/SigmaHQ/sigma/blob/0.22-699-g29a5c6278/rules/windows/builtin/security/win_security_dcsync.yml -- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory tags: analytic_story: - Sneaky Active Directory Persistence Tricks diff --git a/detections/endpoint/windows_admon_default_group_policy_object_modified.yml b/detections/endpoint/windows_admon_default_group_policy_object_modified.yml index 8fb982e3cc..c9c7b2a75d 100644 --- a/detections/endpoint/windows_admon_default_group_policy_object_modified.yml +++ b/detections/endpoint/windows_admon_default_group_policy_object_modified.yml @@ -1,8 +1,8 @@ name: Windows Admon Default Group Policy Object Modified id: 83458004-db60-4170-857d-8572f16f070b -version: 3 -date: '2024-07-02' -author: Mauricio Velazco, Dean Luxton, Splunk +version: 2 +date: '2024-05-28' +author: Mauricio Velazco, Splunk status: production type: TTP data_source: @@ -15,10 +15,10 @@ description: The following analytic detects modifications to the default Group P persistence, or deploy malware across multiple hosts. If confirmed malicious, such modifications could lead to widespread policy enforcement changes, unauthorized access, and potential compromise of the entire domain environment. -search: ' `admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*" (displayName="Default Domain Policy" OR displayName="Default Domain Controllers Policy") - | appendpipe [ - | map search="search `wineventlog_security` EventCode=5136 AttributeSyntaxOID=2.5.5.12 AttributeValue=$displayName$" | rename AttributeValue as displayName] - | stats min(_time) as _time values(displayName) as gp_name, values(gPCFileSysPath) as gPCFileSysPath, values(src_user) as src_user, values(dest) as dest, values(dest_category) as dest_category, values(src_user_category) as src_user_category by displayName +search: ' `admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*" + (displayName="Default Domain Policy" OR displayName="Default Domain Controllers + Policy") | stats min(_time) as firstTime max(_time) as lastTime values(gPCFileSysPath) + by dcName, displayName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_admon_default_group_policy_object_modified_filter`' how_to_implement: To successfully implement this search, you need to be monitoring Active Directory logs using Admon. Details can be found here diff --git a/detections/endpoint/windows_admon_group_policy_object_created.yml b/detections/endpoint/windows_admon_group_policy_object_created.yml index ed7daf9221..a200ad7329 100644 --- a/detections/endpoint/windows_admon_group_policy_object_created.yml +++ b/detections/endpoint/windows_admon_group_policy_object_created.yml @@ -1,8 +1,8 @@ name: Windows Admon Group Policy Object Created id: 69201633-30d9-48ef-b1b6-e680805f0582 -version: 3 -date: '2024-07-02' -author: Mauricio Velazco, Dean Luxton, Splunk +version: 2 +date: '2024-05-20' +author: Mauricio Velazco, Splunk status: production type: TTP data_source: @@ -14,11 +14,10 @@ description: The following analytic detects the creation of a new Group Policy O across an Active Directory network. If confirmed malicious, this activity could allow attackers to control system configurations, deploy ransomware, or propagate malware, significantly compromising the network's security. -search: ' `admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*" versionNumber=0 displayName!="New Group Policy Object" - | appendpipe [ - | map search="search `wineventlog_security` EventCode=5136 AttributeSyntaxOID=2.5.5.12 AttributeValue=$displayName$" | rename AttributeValue as displayName] - | stats min(_time) as _time values(displayName) as gp_name, values(gPCFileSysPath) as gPCFileSysPath, values(src_user) as src_user, values(dest) as dest, values(dest_category) as dest_category, values(src_user_category) as src_user_category by displayName - | `windows_admon_group_policy_object_created_filter`' +search: ' `admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*" + versionNumber=0 displayName!="New Group Policy Object" | stats min(_time) as firstTime + max(_time) as lastTime values(gPCFileSysPath) by dcName, displayName | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_admon_group_policy_object_created_filter`' how_to_implement: To successfully implement this search, you need to be monitoring Active Directory logs using Admon. Details can be found here https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/Data/MonitorActiveDirectory diff --git a/lookups/privileged_azure_ad_roles.csv b/lookups/privileged_azure_ad_roles.csv index b3c897e0e7..d4260b6ba3 100644 --- a/lookups/privileged_azure_ad_roles.csv +++ b/lookups/privileged_azure_ad_roles.csv @@ -1,28 +1,26 @@ "azureadrole","isprvilegedadrole","description" -"""Application Administrator""","True","Can create and manage all aspects of app registrations and enterprise apps." -"""Application Developer""","True","Can create application registrations independent of the 'Users can register applications' setting." """Authentication Administrator""","True","Can access to view, set and reset authentication method information for any non-admin user." -"""Authentication Extensibility Administrator""","True","Customize sign in and sign up experiences for users by creating and managing custom authentication extensions." -"""B2C IEF Keyset Administrator""","True","Can manage secrets for federation and encryption in the Identity Experience Framework (IEF)." +"""Authentication Policy Administrator""","True","Can create and manage the authentication methods policy, tenant-wide MFA settings, password protection policy, and verifiable credentials." +"""Azure AD Joined Device Local Administrator""","True","Users assigned to this role are added to the local administrators group on Azure AD-joined devices." +"""Azure DevOps Administrator""","True","Can manage Azure DevOps policies and settings." +"""Azure Information Protection Administrator""","True","Can manage all aspects of the Azure Information Protection product." """Cloud Application Administrator""","True","Can create and manage all aspects of app registrations and enterprise apps except App Proxy." -"""Cloud Device Administrator""","True","Limited access to manage devices in Microsoft Entra ID." +"""Cloud Device Administrator""","True","Limited access to manage devices in Azure AD." +"""Compliance Administrator""","True","Can read and manage compliance configuration and reports in Azure AD and Microsoft 365." """Conditional Access Administrator""","True","Can manage Conditional Access capabilities." -"""Directory Synchronization Accounts""","True","Only used by Microsoft Entra Connect and Microsoft Entra Cloud Sync services." -"""Directory Writers""","True","Can read and write basic directory information. For granting access to applications, not intended for users." -"""Domain Name Administrator""","True","Can manage domain names in cloud and on-premises." +"""Exchange Administrator""","True","Can manage all aspects of the Exchange product." """External Identity Provider Administrator""","True","Can configure identity providers for use in direct federation." -"""Global Administrator""","True","Can manage all aspects of Microsoft Entra ID and Microsoft services that use Microsoft Entra identities." -"""Global Reader""","True","Can read everything that a Global Administrator can, but not update anything." +"""Groups Administrator""","True","Members of this role can create/manage groups, create/manage groups settings like naming and expiration policies, and view groups activity and audit reports." """Helpdesk Administrator""","True","Can reset passwords for non-administrators and Helpdesk Administrators." -"""Hybrid Identity Administrator""","True","Manage Active Directory to Microsoft Entra cloud provisioning, Microsoft Entra Connect, pass-through authentication (PTA), password hash synchronization (PHS), seamless single sign-on (seamless SSO), and federation settings. Does not have access to manage Microsoft Entra Connect Health." +"""Hybrid Identity Administrator""","True","Can manage AD to Azure AD cloud provisioning, Azure AD Connect, Pass-through Authentication (PTA), Password hash synchronization (PHS), Seamless Single sign-on (Seamless SSO), and federation settings." """Intune Administrator""","True","Can manage all aspects of the Intune product." -"""Lifecycle Workflows Administrator""","True","Create and manage all aspects of workflows and tasks associated with Lifecycle Workflows in Microsoft Entra ID." -"""Partner Tier1 Support""","True","Do not use - not intended for general use." -"""Partner Tier2 Support""","True","Do not use - not intended for general use." +"""License Administrator""","True","Can manage product licenses on users and groups." +"""Network Administrator""","True","Can manage network locations and review enterprise network design insights for Microsoft 365 Software as a Service applications." """Password Administrator""","True","Can reset passwords for non-administrators and Password Administrators." -"""Privileged Authentication Administrator""","True","Can access to view, set and reset authentication method information for any user (admin or non-admin)." -"""Privileged Role Administrator""","True","Can manage role assignments in Microsoft Entra ID, and all aspects of Privileged Identity Management." -"""Security Administrator""","True","Can read security information and reports, and manage configuration in Microsoft Entra ID and Office 365." -"""Security Operator""","True","Creates and manages security events." -"""Security Reader""","True","Can read security information and reports in Microsoft Entra ID and Office 365." -"""User Administrator""","True","Can manage all aspects of users and groups, including resetting passwords for limited admins." \ No newline at end of file +"""Privileged Role Administrator""","True","Can manage role assignments in Azure AD, and all aspects of Privileged Identity Management." +"""Security Administrator""","True","Can read security information and reports, and manage configuration in Azure AD and Office 365." +"""SharePoint Administrator""","True","Can manage all aspects of the SharePoint service." +"""Teams Administrator""","True","Can manage the Microsoft Teams service." +"""User Administrator""","True","Can manage all aspects of users and groups, including resetting passwords for limited admins." +"""Windows 365 Administrator""","True","Can provision and manage all aspects of Cloud PCs." + From 6a6fe2b59dc9332930bea0b506d4d670fb33e199 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Tue, 2 Jul 2024 12:36:27 +1000 Subject: [PATCH 05/15] Revert "Adding pwd spray detection" This reverts commit 9cb3d6cc34068540db94116eff67e837408779b9. --- ...ct_distributed_password_spray_attempts.yml | 69 ------------------- 1 file changed, 69 deletions(-) delete mode 100644 detections/application/detect_distributed_password_spray_attempts.yml diff --git a/detections/application/detect_distributed_password_spray_attempts.yml b/detections/application/detect_distributed_password_spray_attempts.yml deleted file mode 100644 index be4c070da1..0000000000 --- a/detections/application/detect_distributed_password_spray_attempts.yml +++ /dev/null @@ -1,69 +0,0 @@ -name: Detect Distributed Password Spray Attempts -id: b1a82fc8-8a9f-4344-9ec2-bde5c5331b57 -version: 1 -date: '2023-11-01' -author: Dean Luxton -status: production -type: Hunting -data_source: -- Authentication Datamodel -description: This analytic uses the 3-sigma approach to detect a distributed password spray attack. Utilising the authentication datamodel this detection is affective for all CIM mapped authication events. -search: '| tstats `security_content_summariesonly` dc(Authentication.user) AS unique_accounts dc(Authentication.src) as unique_src count(Authentication.user) as total_failures from datamodel=Authentication.Authentication where Authentication.action="failure" by Authentication.action, Authentication.signature_id, sourcetype, _time span=2m - | `drop_dm_object_name("Authentication")` - ```fill out time buckets for 0-count events during entire search length``` - | appendpipe [| timechart limit=0 span=5m count | table _time] - | fillnull value=0 unique_accounts, unique_src - ``` remove duplicate & empty time buckets``` - | sort - total_failures - | dedup _time - ``` Create aggregation field & apply to all null events``` - | eval counter=sourcetype+"__"+signature_id - | eventstats values(counter) as fnscounter | eval counter=coalesce(counter,fnscounter) - ``` 3-sigma detection logic ``` - | eventstats avg(unique_accounts) as comp_avg_user , stdev(unique_accounts) as comp_std_user avg(unique_src) as comp_avg_src , stdev(unique_src) as comp_std_src by counter - | eval upperBoundUser=(comp_avg_user+comp_std_user*3), upperBoundsrc=(comp_avg_src+comp_std_src*3) - | eval isOutlier=if((unique_accounts > 30 and unique_accounts >= upperBoundUser) and (unique_src > 30 and unique_accounts >= upperBoundsrc), 1, 0) - | replace "::ffff:*" with * in src - | where isOutlier=1 - | foreach * - [ eval <> = if(<>="null",null(),<>)] - | table _time, action, unique_src, unique_accounts, total_failures, sourcetype, signature_id - | sort - total_failures | `detect_distributed_password_spray_attempts_filter`' -how_to_implement: Ensure in-scope authentication data is CIM mapped and the src field is populated with the source device. Also ensure fill_nullvalue is set within the macro security_content_summariesonly. -known_false_positives: It is common to see a spike of legitimate failed authentication events on monday mornings. -references: -- https://attack.mitre.org/techniques/T1110/003/ -tags: - analytic_story: - - Compromised User Account - - Active Directory Password Spraying - asset_type: Endpoint - atomic_guid: - - 90bc2e54-6c84-47a5-9439-0a2a92b4b175 - confidence: 70 - impact: 70 - message: Distributed Password Spray Attempt Detected - mitre_attack_id: - - T1110.003 - - T1110 - observable: - - name: src - type: Endpoint - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 49 - required_fields: - - Authentication.action - - Authentication.user - - Authentication.src - security_domain: access -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techni[…]ure_ad_distributed_spray/azure_ad_distributed_spray.log - source: azure:monitor:aad - sourcetype: azure:monitor:aad \ No newline at end of file From 8f951e80b0ec584b94d898b582be836f7c1c77c3 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Tue, 2 Jul 2024 13:00:04 +1000 Subject: [PATCH 06/15] updating detections --- ...dows_ad_dangerous_deny_acl_modification.yml | 10 +++++----- ...ows_ad_dangerous_group_acl_modification.yml | 8 ++++---- ...dows_ad_dangerous_user_acl_modification.yml | 10 +++++----- ...ows_ad_dcshadow_privileges_acl_addition.yml | 12 ++++++------ .../windows_ad_domain_root_acl_deletion.yml | 8 ++++---- ...windows_ad_domain_root_acl_modification.yml | 8 ++++---- .../windows_ad_gpo_new_cse_addition.yml | 2 +- .../windows_ad_hidden_ou_creation.yml | 10 +++++----- .../windows_ad_object_owner_updated.yml | 4 ++-- ...indows_ad_privileged_group_modification.yml | 2 +- .../windows_ad_self_dacl_assignment.yml | 15 ++++++++------- ...ws_ad_suspicious_attribute_modification.yml | 2 +- .../windows_ad_suspicious_gpo_modification.yml | 2 +- .../windows_ad_adminsdholder_acl_modified.yml | 18 +++++++++++------- ...dows_ad_domain_replication_acl_addition.yml | 8 ++++---- 15 files changed, 62 insertions(+), 57 deletions(-) diff --git a/detections/application/windows_ad_dangerous_deny_acl_modification.yml b/detections/application/windows_ad_dangerous_deny_acl_modification.yml index 9cf52b9a54..a565b354ae 100644 --- a/detections/application/windows_ad_dangerous_deny_acl_modification.yml +++ b/detections/application/windows_ad_dangerous_deny_acl_modification.yml @@ -18,14 +18,14 @@ search: >- | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" - | lookup msad_guid_lookup.csv guid as aceObjectGuid OUTPUT displayName as ControlAccessRights - | lookup ace_access_rights_lookup.csv access_rights_string as AccessRights OUTPUT access_rights_value - | lookup ace_type_lookup.csv ace_type_string as aceType OUTPUT ace_type_value as aceType - | lookup ace_flag_lookup.csv flag_string as aceFlags OUTPUT flag_value as ace_flag_value + | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType + | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` - | lookup builtin_groups_lookup.csv builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') diff --git a/detections/application/windows_ad_dangerous_group_acl_modification.yml b/detections/application/windows_ad_dangerous_group_acl_modification.yml index c2bdd58151..e0aa59469f 100644 --- a/detections/application/windows_ad_dangerous_group_acl_modification.yml +++ b/detections/application/windows_ad_dangerous_group_acl_modification.yml @@ -18,14 +18,14 @@ search: >- | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" - | lookup ace_type_lookup.csv ace_type_string as aceType OUTPUT ace_type_value as aceType - | lookup ace_flag_lookup.csv flag_string as aceFlags OUTPUT flag_value as ace_flag_value - | lookup ace_access_rights_lookup.csv access_rights_string as AccessRights OUTPUT access_rights_value + | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType + | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value + | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` - | lookup builtin_groups_lookup.csv builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceInheritance=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') diff --git a/detections/application/windows_ad_dangerous_user_acl_modification.yml b/detections/application/windows_ad_dangerous_user_acl_modification.yml index 7e99d1c55f..b08d07f95a 100644 --- a/detections/application/windows_ad_dangerous_user_acl_modification.yml +++ b/detections/application/windows_ad_dangerous_user_acl_modification.yml @@ -18,14 +18,14 @@ search: >- | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" - | lookup msad_guid_lookup.csv guid as aceObjectGuid OUTPUT displayName as ControlAccessRights - | lookup ace_access_rights_lookup.csv access_rights_string as AccessRights OUTPUT access_rights_value - | lookup ace_type_lookup.csv ace_type_string as aceType OUTPUT ace_type_value as aceType - | lookup ace_flag_lookup.csv flag_string as aceFlags OUTPUT flag_value as ace_flag_value + | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType + | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` - | lookup builtin_groups_lookup.csv builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') diff --git a/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml b/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml index 8a3c15a9e0..d6dab5e96f 100644 --- a/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml +++ b/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml @@ -1,4 +1,4 @@ -name: Windows AD DCShadow ACL Addition +name: Windows AD DCShadow Privileges ACL Addition id: ae915743-1aa8-4a94-975c-8062ebc8b723 version: 1 date: '2023-11-10' @@ -20,17 +20,17 @@ search: >- | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights - | lookup ace_access_rights_lookup.csv access_rights_string as AccessRights OUTPUT access_rights_value - | lookup ace_type_lookup.csv ace_type_string as aceType OUTPUT ace_type_value - | lookup ace_flag_lookup.csv flag_string as aceFlags OUTPUT flag_value as ace_flag_value + | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value + | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` - | lookup builtin_groups_lookup.csv builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user user | search (aceControlAccessRights="DS-Install-Replica" AND aceControlAccessRights="DS-Replication-Manage-Topology" AND aceControlAccessRights="DS-Replication-Synchronize") OR (aceControlAccessRights="9923a32a-3607-11d2-b9be-0000f87a36b2" AND aceControlAccessRights="1131f6ab-9c07-11d1-f79f-00c04fc2dcd2" AND aceControlAccessRights="1131f6ac-9c07-11d1-f79f-00c04fc2dcd2") - | `windows_ad_dcshadow_acl_addition_filter` + | `windows_ad_dcshadow_privileges_acl_addition_filter` how_to_implement: See link in references for how to configure logging for these eventcodes. known_false_positives: Unknown references: diff --git a/detections/application/windows_ad_domain_root_acl_deletion.yml b/detections/application/windows_ad_domain_root_acl_deletion.yml index fa0476aa2a..a18e787a8b 100644 --- a/detections/application/windows_ad_domain_root_acl_deletion.yml +++ b/detections/application/windows_ad_domain_root_acl_deletion.yml @@ -19,13 +19,13 @@ search: >- | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights - | lookup ace_access_rights_lookup.csv access_rights_string as AccessRights OUTPUT access_rights_value - | lookup ace_type_lookup.csv ace_type_string as aceType OUTPUT ace_type_value - | lookup ace_flag_lookup.csv flag_string as aceFlags OUTPUT flag_value as ace_flag_value + | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value + | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` - | lookup builtin_groups_lookup.csv builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(old_values) as old_values by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') diff --git a/detections/application/windows_ad_domain_root_acl_modification.yml b/detections/application/windows_ad_domain_root_acl_modification.yml index 875a34656a..c58ae5113a 100644 --- a/detections/application/windows_ad_domain_root_acl_modification.yml +++ b/detections/application/windows_ad_domain_root_acl_modification.yml @@ -19,13 +19,13 @@ search: >- | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights - | lookup ace_access_rights_lookup.csv access_rights_string as AccessRights OUTPUT access_rights_value - | lookup ace_type_lookup.csv ace_type_string as aceType OUTPUT ace_type_value - | lookup ace_flag_lookup.csv flag_string as aceFlags OUTPUT flag_value as ace_flag_value + | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value + | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` - | lookup builtin_groups_lookup.csv builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",'access_rights_value'), aceType=ace_type_value, aceFlags=coalesce(ace_flag_value,"This object only"), aceControlAccessRights=ControlAccessRights, user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') diff --git a/detections/application/windows_ad_gpo_new_cse_addition.yml b/detections/application/windows_ad_gpo_new_cse_addition.yml index 512be6b2bc..f125941950 100644 --- a/detections/application/windows_ad_gpo_new_cse_addition.yml +++ b/detections/application/windows_ad_gpo_new_cse_addition.yml @@ -15,7 +15,7 @@ search: '`wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer | rex field=ObjectDN max_match=10000 "CN=(?P\{.*?\})" | mvexpand new_values | where NOT new_values IN (old_values,"{00000000-0000-0000-0000-000000000000}",policy_guid) AND match(new_values, "^\{[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\}") - | lookup msad_guid_lookup.csv guid as new_values OUTPUTNEW displayName as policyType + | lookup msad_guid_lookup guid as new_values OUTPUTNEW displayName as policyType | eval newPolicy=if(policyType like "%",policyType,new_values) | join ObjectDN [| search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update | stats latest(displayName) as displayName by distinguishedName | eval ObjectDN=upper(distinguishedName)] | stats values(OpCorrelationID) as OpCorrelationID values(src_user) as src_user values(SubjectLogonId) as SubjectLogonId values(newPolicy) as newPolicy values(displayName) as policyName by ObjectDN diff --git a/detections/application/windows_ad_hidden_ou_creation.yml b/detections/application/windows_ad_hidden_ou_creation.yml index ef2e23e250..5e36680449 100644 --- a/detections/application/windows_ad_hidden_ou_creation.yml +++ b/detections/application/windows_ad_hidden_ou_creation.yml @@ -18,14 +18,14 @@ search: >- | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" - | lookup msad_guid_lookup.csv guid as aceObjectGuid OUTPUT displayName as ControlAccessRights - | lookup ace_access_rights_lookup.csv access_rights_string as AccessRights OUTPUT access_rights_value - | lookup ace_type_lookup.csv ace_type_string as aceType OUTPUT ace_type_value as aceType - | lookup ace_flag_lookup.csv flag_string as aceFlags OUTPUT flag_value as ace_flag_value + | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType + | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` - | lookup builtin_groups_lookup.csv builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') diff --git a/detections/application/windows_ad_object_owner_updated.yml b/detections/application/windows_ad_object_owner_updated.yml index 16609a4a95..2d5118f931 100644 --- a/detections/application/windows_ad_object_owner_updated.yml +++ b/detections/application/windows_ad_object_owner_updated.yml @@ -19,8 +19,8 @@ search: ' `wineventlog_security` EventCode=5136 | lookup identity_lookup_expanded objectSid as old_owner OUTPUT downLevelDomainName as old_owner_user | lookup admon_groups_def objectSid as old_owner OUTPUT cn as old_owner_group ``` - | lookup builtin_groups_lookup.csv builtin_group_string as new_owner_group OUTPUT builtin_group_name as new_owner_group_builtin_group - | lookup builtin_groups_lookup.csv builtin_group_string as old_owner OUTPUT builtin_group_name as old_owner_group_builtin_group + | lookup builtin_groups_lookup builtin_group_string as new_owner_group OUTPUT builtin_group_name as new_owner_group_builtin_group + | lookup builtin_groups_lookup builtin_group_string as old_owner OUTPUT builtin_group_name as old_owner_group_builtin_group | eval user=coalesce(new_owner_user, new_owner_group, new_owner_group_builtin_group, new_owner), previousOwner=coalesce(old_owner_user, old_owner_group, old_owner_group_builtin_group, old_owner) | stats values(previousOwner) as previousOwner values(user) as user values(SubjectLogonId) as SubjectLogonId by _time ObjectClass ObjectDN src_user OpCorrelationID DSName | `windows_ad_object_owner_updated_filter`' diff --git a/detections/application/windows_ad_privileged_group_modification.yml b/detections/application/windows_ad_privileged_group_modification.yml index efd0127f03..82aaff088d 100644 --- a/detections/application/windows_ad_privileged_group_modification.yml +++ b/detections/application/windows_ad_privileged_group_modification.yml @@ -11,7 +11,7 @@ description: Detect users added to privileged AD Groups. search: '`wineventlog_security` EventCode IN (4728) | stats min(_time) as _time dc(user) as usercount, values(user) as user values(user_category) as user_category values(src_user_category) as src_user_category values(dvc) as dvc by signature, Group_Name,src_user | lookup admon_groups_def cn as Group_Name OUTPUT category - | where category="privileged" | `windows_ad_privileged_group_modification`' + | where category="privileged" | `windows_ad_privileged_group_modification_filter`' how_to_implement: This analytic requires eventCode 4728 to be ingested along with the admon_groups_def lookup being configured to include a list of AD groups along with a category to identify privileged groups. See splunkbase app listed in the references for further details. known_false_positives: None diff --git a/detections/application/windows_ad_self_dacl_assignment.yml b/detections/application/windows_ad_self_dacl_assignment.yml index bfc00b4eba..e90a015ec8 100644 --- a/detections/application/windows_ad_self_dacl_assignment.yml +++ b/detections/application/windows_ad_self_dacl_assignment.yml @@ -18,14 +18,15 @@ search: >- | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" - | lookup ace_type_lookup.csv ace_type_string as aceType OUTPUT ace_type_value as aceType - | lookup ace_flag_lookup.csv flag_string as aceFlags OUTPUT flag_value as ace_flag_value - | lookup ace_access_rights_lookup.csv access_rights_string as AccessRights OUTPUT access_rights_value - | lookup msad_guid_lookup.csv guid as aceObjectGuid OUTPUT displayName as ControlAccessRights - ``` Optional SID resolution lookups + | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType + | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value + | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user - | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` - | lookup builtin_groups_lookup.csv builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group + ``` + | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceInheritance=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') diff --git a/detections/application/windows_ad_suspicious_attribute_modification.yml b/detections/application/windows_ad_suspicious_attribute_modification.yml index 22098e9fd7..e83a8b15ee 100644 --- a/detections/application/windows_ad_suspicious_attribute_modification.yml +++ b/detections/application/windows_ad_suspicious_attribute_modification.yml @@ -28,7 +28,7 @@ tags: asset_type: Endpoint confidence: 100 impact: 100 - message: $src_user$ has added $user$ $aceAccessRights$ ACL rights to $ObjectClass$ $ObjectDN$ + message: $src_user$ has added $AttributeLDAPDisplayName$ ACL rights to $ObjectClass$ $ObjectDN$ mitre_attack_id: - T1550 - T1222 diff --git a/detections/application/windows_ad_suspicious_gpo_modification.yml b/detections/application/windows_ad_suspicious_gpo_modification.yml index 5690ca4ba8..45e66e631c 100644 --- a/detections/application/windows_ad_suspicious_gpo_modification.yml +++ b/detections/application/windows_ad_suspicious_gpo_modification.yml @@ -24,7 +24,7 @@ search: >- | rex field=ObjectDN max_match=10000 "CN=(?P\{.*?\})" | mvexpand new_values | where NOT new_values IN (old_values,"{00000000-0000-0000-0000-000000000000}",policy_guid) AND match(new_values, "^\{[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\}") - | lookup msad_guid_lookup.csv guid as new_values OUTPUTNEW displayName as policyType + | lookup msad_guid_lookup guid as new_values OUTPUTNEW displayName as policyType | eval newPolicy=if(policyType like "%",policyType,new_values) | stats values(OpCorrelationID) as OpCorrelationID values(newPolicy) as newPolicy by ObjectDN | rex field=ObjectDN max_match=10000 "CN=(?P\{.*?\})" diff --git a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml index 3428db7c8d..9852bf6a39 100644 --- a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml +++ b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml @@ -25,14 +25,14 @@ search: >- | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" - | lookup msad_guid_lookup.csv guid as aceObjectGuid OUTPUT displayName as ControlAccessRights - | lookup ace_access_rights_lookup.csv access_rights_string as AccessRights OUTPUT access_rights_value - | lookup ace_type_lookup.csv ace_type_string as aceType OUTPUT ace_type_value - | lookup ace_flag_lookup.csv flag_string as aceFlags OUTPUT flag_value as ace_flag_value + | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value + | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group``` - | lookup builtin_groups_lookup.csv builtin_group_string as aceSid OUTPUTNEW builtin_group_name as builtin_group + | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUTNEW builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user user | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') @@ -59,11 +59,15 @@ tags: asset_type: Endpoint confidence: 70 impact: 80 - message: The AdminSDHolder domain object has been modified on $Computer$ by $SubjectUserName$ + message: The AdminSDHolder domain object has been modified on $Computer$ by $src_user$ mitre_attack_id: - T1546 observable: - - name: SubjectUserName + - name: user + type: User + role: + - Victim + - name: src_user type: User role: - Attacker diff --git a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml index 988329ebbf..3a5b2007de 100644 --- a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml +++ b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml @@ -27,13 +27,13 @@ search: >- | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights - | lookup ace_access_rights_lookup.csv access_rights_string as AccessRights OUTPUT access_rights_value - | lookup ace_type_lookup.csv ace_type_string as aceType OUTPUT ace_type_value - | lookup ace_flag_lookup.csv flag_string as aceFlags OUTPUT flag_value as ace_flag_value + | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value + | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` - | lookup builtin_groups_lookup.csv builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user user | search (aceControlAccessRights="DS-Replication-Get-Changes" AND aceControlAccessRights="DS-Replication-Get-Changes-All") OR (aceControlAccessRights="1131f6aa-9c07-11d1-f79f-00c04fc2dcd2" AND aceControlAccessRights="1131f6ad-9c07-11d1-f79f-00c04fc2dcd2") From 48e0fb245122bc9827de40bcae6e1a778e700611 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Tue, 2 Jul 2024 13:16:44 +1000 Subject: [PATCH 07/15] updating detections --- .../windows_ad_dcshadow_privileges_acl_addition.yml | 6 +----- .../application/windows_ad_suspicious_gpo_modification.yml | 6 +++--- .../endpoint/windows_ad_adminsdholder_acl_modified.yml | 6 +----- 3 files changed, 5 insertions(+), 13 deletions(-) diff --git a/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml b/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml index d6dab5e96f..f65c351315 100644 --- a/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml +++ b/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml @@ -44,7 +44,7 @@ tags: asset_type: Endpoint confidence: 100 impact: 100 - message: $targetDomain$ ACL modification Event Initiated by $src_user$ applying $user$ the minimum required extended rights to perform a DCShadow attack. + message: ACL modification Event Initiated by $src_user$ applying $user$ the minimum required extended rights to perform a DCShadow attack. mitre_attack_id: - T1484 - T1207 @@ -58,10 +58,6 @@ tags: type: User role: - Victim - - name: src_ip - type: Hostname - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/application/windows_ad_suspicious_gpo_modification.yml b/detections/application/windows_ad_suspicious_gpo_modification.yml index 45e66e631c..a652ceb234 100644 --- a/detections/application/windows_ad_suspicious_gpo_modification.yml +++ b/detections/application/windows_ad_suspicious_gpo_modification.yml @@ -9,7 +9,7 @@ data_source: - Windows Security 5136 - Windows Security 5145 description: This analytic looks for a the creation of potentially harmful GPO which could lead to persistence or code execution on remote hosts. - Note, this analyic is looking for the absence of the corresponding 5136 events which is evidence of the GPOs being manually created (using a tool like PowerView) or potentially missing logs. + Note, this analyic is looking for the absence of the corresponding 5136 events which is evidence of the GPOs being manually edited (using a tool like PowerView) or potentially missing logs. search: >- `wineventlog_security` EventCode=5145 ShareName="\\\\*\\SYSVOL" RelativeTargetName IN (*\\ScheduledTasks.xml, *\\Groups.xml, *\\Registry.xml, *\\Services.xml, *\\Scripts\\*) NOT RelativeTargetName=*\\Scripts\\scripts.ini AccessMask=0x2 | rex field=AccessList max_match=0 "(?P%%\d+)" @@ -35,7 +35,7 @@ search: >- | `windows_ad_suspicious_gpo_modification_filter` how_to_implement: Ingest EventCodes 5145 and 5136 from domain controllers. Additional SACLs required to capture EventCode 5136, see references for further information on how to configure this. The Group Policy - Audit Detailed File Share will need to be enabled on the DCs to generate event code 5145, this event is very noisy on DCs, consider tuning out sysvol events which do not match access mask 0x2. -known_false_positives: When a GPO is manually created and there are no 5136 events. +known_false_positives: When a GPO is manually edited and 5136 events are not logging to Splunk. references: - https://github.com/PowerShellMafia/PowerSploit/blob/26a0757612e5654b4f792b012ab8f10f95d391c9/Recon/PowerView.ps1#L5907-L6122 - https://github.com/X-C3LL/GPOwned @@ -49,7 +49,7 @@ tags: asset_type: Endpoint confidence: 100 impact: 100 - message: $src_user$ has added new GPO Client Side Extensions $newPolicy$ to the policy $policyName$ + message: $src_user$ has added new GPO Client Side Extensions $folder$ to the policy $gpo_guid$ mitre_attack_id: - T1484 - T1484.001 diff --git a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml index 9852bf6a39..f4d2072016 100644 --- a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml +++ b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml @@ -59,7 +59,7 @@ tags: asset_type: Endpoint confidence: 70 impact: 80 - message: The AdminSDHolder domain object has been modified on $Computer$ by $src_user$ + message: The AdminSDHolder domain object $ObjectDN$ has been modified by $src_user$ mitre_attack_id: - T1546 observable: @@ -71,10 +71,6 @@ tags: type: User role: - Attacker - - name: Computer - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security From 60807016022f61b8c5a00c154582b52df50a0a8b Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Tue, 2 Jul 2024 13:27:54 +1000 Subject: [PATCH 08/15] Adding SA-admon TA --- data_sources/endpoint/Windows_Active_Directory_Admon.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/data_sources/endpoint/Windows_Active_Directory_Admon.yml b/data_sources/endpoint/Windows_Active_Directory_Admon.yml index a0517404e8..fad8bb0495 100644 --- a/data_sources/endpoint/Windows_Active_Directory_Admon.yml +++ b/data_sources/endpoint/Windows_Active_Directory_Admon.yml @@ -4,9 +4,12 @@ author: Patrick Bareiss, Splunk source: ActiveDirectory sourcetype: ActiveDirectory supported_TA: - name: Splunk Add-on for Microsoft Windows + - name: Splunk Add-on for Microsoft Windows version: 8.8.0 url: https://splunkbase.splunk.com/app/742 + - name: Splunk Add-on for Admon Enrichment + version: 1.1.0 + url: https://apps.splunk.com/app/6853/ event_names: [] fields: - _time From 50d9b1aa3633e4d886833bc082961649dc5d4df4 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Tue, 2 Jul 2024 13:33:30 +1000 Subject: [PATCH 09/15] Adding SA-admon TA --- contentctl.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/contentctl.yml b/contentctl.yml index e223fd167b..81ed15848d 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -182,4 +182,10 @@ apps: version: 1.9.2 description: description of app hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz +- uid: 6853 + title: Splunk Add-on for Admon Enrichment + appid: SA-admon + version: 1.1.0 + description: description of app + hardcoded_path: ~/Downloads/splunk-add-on-for-admon-enrichment_110.tgz githash: d6fac80e6d50ae06b40f91519a98489d4ce3a3fd From 350efe436f62de63bb8fce85191326b3936fe42e Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Tue, 2 Jul 2024 13:34:20 +1000 Subject: [PATCH 10/15] Adding SA-admon TA --- contentctl.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/contentctl.yml b/contentctl.yml index 81ed15848d..09c2c24269 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -187,5 +187,5 @@ apps: appid: SA-admon version: 1.1.0 description: description of app - hardcoded_path: ~/Downloads/splunk-add-on-for-admon-enrichment_110.tgz + hardcoded_path: ~/Downloads/splunk-add-on-for-admon-enrichment_110.spl githash: d6fac80e6d50ae06b40f91519a98489d4ce3a3fd From 6b9133a22fa9c5d2a5e36d39098316d0028abd91 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Tue, 2 Jul 2024 13:36:58 +1000 Subject: [PATCH 11/15] Adding SA-admon TA --- contentctl.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/contentctl.yml b/contentctl.yml index 09c2c24269..a0601f0383 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -187,5 +187,5 @@ apps: appid: SA-admon version: 1.1.0 description: description of app - hardcoded_path: ~/Downloads/splunk-add-on-for-admon-enrichment_110.spl + hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-admon-enrichment_110.tgz githash: d6fac80e6d50ae06b40f91519a98489d4ce3a3fd From 2cf5d2d1a490c35c09652e26de1c7f7d9e26acda Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 1 Aug 2024 16:10:22 -0700 Subject: [PATCH 12/15] updating for testing --- .github/workflows/build.yml | 2 +- .github/workflows/unit-testing.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 13e95e8001..e65c530755 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -23,7 +23,7 @@ jobs: - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | - pip install contentctl==4.2.0 + pip install contentctl==4.2.2 git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git - name: Running build with enrichments diff --git a/.github/workflows/unit-testing.yml b/.github/workflows/unit-testing.yml index 9293c32204..1bc24b42a9 100644 --- a/.github/workflows/unit-testing.yml +++ b/.github/workflows/unit-testing.yml @@ -24,7 +24,7 @@ jobs: - name: Install Python Dependencies and ContentCTL run: | python -m pip install --upgrade pip - pip install contentctl==4.2.0 + pip install contentctl==4.2.2 # Running contentctl test with a few arguments, before running the command make sure you checkout into the current branch of the pull request. This step only performs unit testing on all the changes against the target-branch. In most cases this target branch will be develop # Make sure we check out the PR, even if it actually lives in a fork From ec1c527d17267fbd4c299c23950cfdb2de80970b Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Thu, 8 Aug 2024 15:48:37 +1000 Subject: [PATCH 13/15] updating detections --- ...ows_ad_dangerous_deny_acl_modification.yml | 6 ++- ...ws_ad_dangerous_group_acl_modification.yml | 9 +++- ...ows_ad_dangerous_user_acl_modification.yml | 9 +++- ...ws_ad_dcshadow_privileges_acl_addition.yml | 8 +-- .../windows_ad_domain_root_acl_deletion.yml | 4 +- ...indows_ad_domain_root_acl_modification.yml | 4 +- .../application/windows_ad_gpo_deleted.yml | 13 +++-- .../application/windows_ad_gpo_disabled.yml | 13 +++-- .../windows_ad_gpo_new_cse_addition.yml | 16 ++++-- .../windows_ad_hidden_ou_creation.yml | 4 +- .../windows_ad_object_owner_updated.yml | 4 +- .../windows_ad_self_dacl_assignment.yml | 4 +- ...s_ad_suspicious_attribute_modification.yml | 18 ++++--- ...windows_ad_suspicious_gpo_modification.yml | 52 +++++++++---------- ...ows_ad_domain_replication_acl_addition.yml | 4 +- 15 files changed, 107 insertions(+), 61 deletions(-) diff --git a/detections/application/windows_ad_dangerous_deny_acl_modification.yml b/detections/application/windows_ad_dangerous_deny_acl_modification.yml index a565b354ae..b7f6bee2cc 100644 --- a/detections/application/windows_ad_dangerous_deny_acl_modification.yml +++ b/detections/application/windows_ad_dangerous_deny_acl_modification.yml @@ -7,7 +7,7 @@ status: production type: TTP data_source: - Windows Security 5136 -description: ACL modification event denying the ability to enumerate permissions. +description: This detection identifies an Active Directory access-control list (ACL) modification event, which applies permissions that deny the ability to enumerate permissions of the object. search: >- `wineventlog_security` EventCode=5136 | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId @@ -31,7 +31,9 @@ search: >- | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') | search aceType IN ("Access denied",D) AND aceAccessRights IN ("Full control","Read permissions",RC) | `windows_ad_dangerous_deny_acl_modification_filter` -how_to_implement: See link in references for how to configure logging for these eventcodes. Include lookups for SID resolution if evt_resolve_ad_obj is set to 0. +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. + See lantern article in references for further on how to onboard AD audit data. Ensure the + wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: None. references: - https://happycamper84.medium.com/sneaky-persistence-via-hidden-objects-in-ad-1c91fc37bf54 diff --git a/detections/application/windows_ad_dangerous_group_acl_modification.yml b/detections/application/windows_ad_dangerous_group_acl_modification.yml index e0aa59469f..ae125e8c7d 100644 --- a/detections/application/windows_ad_dangerous_group_acl_modification.yml +++ b/detections/application/windows_ad_dangerous_group_acl_modification.yml @@ -7,7 +7,10 @@ status: production type: TTP data_source: - Windows Security 5136 -description: Group ACL modification event with potentially dangerous permissions applied. +description: >- + This detection monitors the addition of the following ACLs to an Active Directory group object: "Full control", "All extended rights", "All validated writes", + "Create all child objects", "Delete all child objects", "Delete subtree", "Delete", "Modify permissions", "Modify owner", and "Write all properties". + Such modifications can indicate potential privilege escalation or malicious activity. Immediate investigation is recommended upon alert. search: >- `wineventlog_security` EventCode=5136 ObjectClass=group | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId @@ -31,7 +34,9 @@ search: >- | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') | search NOT aceType IN ("*denied*","D","OD","XD") AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_dangerous_group_acl_modification_filter` -how_to_implement: See link in references for how to configure logging for these eventcodes. Include lookups for SID resolution if evt_resolve_ad_obj is set to 0. +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. + See lantern article in references for further on how to onboard AD audit data. Ensure the + wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: Unknown references: - https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings diff --git a/detections/application/windows_ad_dangerous_user_acl_modification.yml b/detections/application/windows_ad_dangerous_user_acl_modification.yml index b08d07f95a..8cfdbceb4c 100644 --- a/detections/application/windows_ad_dangerous_user_acl_modification.yml +++ b/detections/application/windows_ad_dangerous_user_acl_modification.yml @@ -7,7 +7,10 @@ status: production type: TTP data_source: - Windows Security 5136 -description: User ACL modification event with potentially dangerous permissions applied. +description: >- + This detection monitors the addition of the following ACLs to an Active Directory user object: "Full control","All extended rights","All validated writes", + "Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties". + Such modifications can indicate potential privilege escalation or malicious activity. Immediate investigation is recommended upon alert. search: >- `wineventlog_security` EventCode=5136 ObjectClass=user | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId @@ -31,7 +34,9 @@ search: >- | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') | search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_dangerous_user_acl_modification_filter` -how_to_implement: See link in references for how to configure logging for these eventcodes. Include lookups for SID resolution if evt_resolve_ad_obj is set to 0. +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. + See lantern article in references for further on how to onboard AD audit data. Ensure the + wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: Unknown references: - https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings diff --git a/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml b/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml index f65c351315..07654823a8 100644 --- a/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml +++ b/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml @@ -7,7 +7,7 @@ status: production type: TTP data_source: - Windows Security 5136 -description: Detect ACL modification event applying the minimum required extended rights to perform a DCShadow attack. +description: This detection identifies an Active Directory access-control list (ACL) modification event, which applies the minimum required extended rights to perform the DCShadow attack. search: >- `wineventlog_security` EventCode=5136 ObjectClass=domainDNS | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId @@ -29,9 +29,11 @@ search: >- | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user user - | search (aceControlAccessRights="DS-Install-Replica" AND aceControlAccessRights="DS-Replication-Manage-Topology" AND aceControlAccessRights="DS-Replication-Synchronize") OR (aceControlAccessRights="9923a32a-3607-11d2-b9be-0000f87a36b2" AND aceControlAccessRights="1131f6ab-9c07-11d1-f79f-00c04fc2dcd2" AND aceControlAccessRights="1131f6ac-9c07-11d1-f79f-00c04fc2dcd2") + | search (aceControlAccessRights="Add/Remove Replica In Domain" AND aceControlAccessRights="Manage Replication Topology" AND aceControlAccessRights="Replication Synchronization") OR (aceControlAccessRights="9923a32a-3607-11d2-b9be-0000f87a36b2" AND aceControlAccessRights="1131f6ab-9c07-11d1-f79f-00c04fc2dcd2" AND aceControlAccessRights="1131f6ac-9c07-11d1-f79f-00c04fc2dcd2") | `windows_ad_dcshadow_privileges_acl_addition_filter` -how_to_implement: See link in references for how to configure logging for these eventcodes. +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. + See lantern article in references for further on how to onboard AD audit data. Ensure the + wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: Unknown references: - https://www.labofapenetrationtester.com/2018/04/dcshadow.html diff --git a/detections/application/windows_ad_domain_root_acl_deletion.yml b/detections/application/windows_ad_domain_root_acl_deletion.yml index a18e787a8b..3d117d3d82 100644 --- a/detections/application/windows_ad_domain_root_acl_deletion.yml +++ b/detections/application/windows_ad_domain_root_acl_deletion.yml @@ -30,7 +30,9 @@ search: >- | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(old_values) as old_values by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') | `windows_ad_domain_root_acl_deletion_filter` -how_to_implement: See link in references for how to configure logging for these eventcodes. Include lookups for SID resolution if evt_resolve_ad_obj is set to 0. +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. + See lantern article in references for further on how to onboard AD audit data. Ensure the + wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: Unknown references: - https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings diff --git a/detections/application/windows_ad_domain_root_acl_modification.yml b/detections/application/windows_ad_domain_root_acl_modification.yml index c58ae5113a..b6e2a09041 100644 --- a/detections/application/windows_ad_domain_root_acl_modification.yml +++ b/detections/application/windows_ad_domain_root_acl_modification.yml @@ -30,7 +30,9 @@ search: >- | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') | `windows_ad_domain_root_acl_modification_filter` -how_to_implement: See link in references for how to configure logging for these eventcodes. Include lookups for SID resolution if evt_resolve_ad_obj is set to 0. +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. + See lantern article in references for further on how to onboard AD audit data. Ensure the + wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: Unknown references: - https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings diff --git a/detections/application/windows_ad_gpo_deleted.yml b/detections/application/windows_ad_gpo_deleted.yml index 925c0d625e..7caec33736 100644 --- a/detections/application/windows_ad_gpo_deleted.yml +++ b/detections/application/windows_ad_gpo_deleted.yml @@ -7,7 +7,7 @@ status: production type: TTP data_source: - Windows Security 5136 -description: Windows AD Group Policy Object Deleted +description: This detection identifies when an Active Directory Group Policy is deleted using the Group Policy Management Console. search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=gpLink | eval ObjectDN=upper(ObjectDN) | stats min(_time) as eventTime values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(src_user) as src_user by OpCorrelationID ObjectDN SubjectLogonId | rex field=old_value max_match=10000 "(?i)LDAP://(?Pcn.*?);(?P\d)\]" @@ -18,7 +18,9 @@ search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=gpLink | | join ObjectDN type=outer [| search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update | eval ObjectDN=upper(distinguishedName) | stats latest(displayName) as displayName by ObjectDN ] | stats min(eventTime) as _time values(OpCorrelationID) as OpCorrelationID values(displayName) as policyName values(src_user) as src_user by ObjectDN SubjectLogonId | `windows_ad_gpo_deleted_filter`' -how_to_implement: Ensure you are ingesting AD audit logs, see lantern doc in references for further details. This detection also leverages admon data. Ensure the admon macro is configured with the correct index. +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136, admon data is also used to display + the display name of the GPO. See lantern article in references for further on how to onboard AD audit data. Ensure the + wineventlog_security and admon macros are configured with the correct indexes. known_false_positives: Unknown references: - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory @@ -57,6 +59,9 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_created/gpo_deletion_windows-security-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_deleted/windows-security.log source: XmlWinEventLog:Security - sourcetype: xmlwineventlog \ No newline at end of file + sourcetype: xmlwineventlog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_deleted/windows-admon.log + source: ActiveDirectory + sourcetype: ActiveDirectory \ No newline at end of file diff --git a/detections/application/windows_ad_gpo_disabled.yml b/detections/application/windows_ad_gpo_disabled.yml index 290a148efa..d7b122d2bd 100644 --- a/detections/application/windows_ad_gpo_disabled.yml +++ b/detections/application/windows_ad_gpo_disabled.yml @@ -7,13 +7,15 @@ status: production type: TTP data_source: - Windows Security 5136 -description: Windows AD Group Policy Object Disabled +description: This detection identifies when an Active Directory Group Policy is disabled using the Group Policy Management Console. search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=flags OperationType="%%14674" AttributeValue!=0 | eval AttributeValueExp=case(AttributeValue==0,"Enabled",AttributeValue==1,"User configuration settings disabled",AttributeValue==2,"Computer configuration settings disabled",AttributeValue==3,"Disabled"), ObjectDN=upper(ObjectDN) | join ObjectDN type=outer [| search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update | eval ObjectDN=upper(distinguishedName) | stats latest(displayName) as displayName by ObjectDN ] | stats min(_time) as _time values(AttributeValue) as AttributeValue values(AttributeValueExp) as AttributeValueExp values(OpCorrelationID) as OpCorrelationID values(displayName) as policyName values(src_user) as src_user by ObjectDN SubjectLogonId | `windows_ad_gpo_disabled_filter`' -how_to_implement: Ensure you are ingesting AD audit logs, see lantern doc in references for further details. This detection also leverages admon data. Ensure the admon macro is configured with the correct index. +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136, admon data is also used to display + the display name of the GPO. See lantern article in references for further on how to onboard AD audit data. Ensure the + wineventlog_security and admon macros are configured with the correct indexes. known_false_positives: Unknown references: - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory @@ -52,6 +54,9 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_created/gpo_disabled_windows-security-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_disabled/windows-security.log source: XmlWinEventLog:Security - sourcetype: xmlwineventlog \ No newline at end of file + sourcetype: xmlwineventlog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_disabled/windows-admon.log + source: ActiveDirectory + sourcetype: ActiveDirectory \ No newline at end of file diff --git a/detections/application/windows_ad_gpo_new_cse_addition.yml b/detections/application/windows_ad_gpo_new_cse_addition.yml index f125941950..7560e91b43 100644 --- a/detections/application/windows_ad_gpo_new_cse_addition.yml +++ b/detections/application/windows_ad_gpo_new_cse_addition.yml @@ -7,7 +7,7 @@ status: production type: TTP data_source: - Windows Security 5136 -description: New Client Side Extension added to a Group Policy Object. +description: This detection identifies when a a new client side extension is added to an Active Directory Group Policy using the Group Policy Management Console. search: '`wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=gPCMachineExtensionNames | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "(?P\{.*?\})" @@ -20,12 +20,15 @@ search: '`wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer | join ObjectDN [| search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update | stats latest(displayName) as displayName by distinguishedName | eval ObjectDN=upper(distinguishedName)] | stats values(OpCorrelationID) as OpCorrelationID values(src_user) as src_user values(SubjectLogonId) as SubjectLogonId values(newPolicy) as newPolicy values(displayName) as policyName by ObjectDN | `windows_ad_gpo_new_cse_addition_filter`' -how_to_implement: Ensure you are ingesting AD audit logs, see lantern doc in references for further details. This detection also leverages admon data. Ensure the admon macro is configured with the correct index. -known_false_positives: Genuine GPO uage +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136, admon data is also used to display + the display name of the GPO. See lantern article in references for further on how to onboard AD audit data. Ensure the + wineventlog_security and admon macros are configured with the correct indexes. +known_false_positives: General usage of group policy will trigger this detection, also please not GPOs modified using tools such as SharpGPOAbuse will not generate the AD audit events which enable this detection. references: - https://wald0.com/?p=179 - https://learn.microsoft.com/en-gb/archive/blogs/mempson/group-policy-client-side-extension-list - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +- https://github.com/FSecureLABS/SharpGPOAbuse tags: analytic_story: - Sneaky Active Directory Persistence Tricks @@ -67,6 +70,9 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_created/gpo_new_cse_windows-security-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_new_cse/windows-security.log source: XmlWinEventLog:Security - sourcetype: xmlwineventlog \ No newline at end of file + sourcetype: xmlwineventlog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_new_cse/windows-admon.log + source: ActiveDirectory + sourcetype: ActiveDirectory \ No newline at end of file diff --git a/detections/application/windows_ad_hidden_ou_creation.yml b/detections/application/windows_ad_hidden_ou_creation.yml index 5e36680449..edc4f97dc3 100644 --- a/detections/application/windows_ad_hidden_ou_creation.yml +++ b/detections/application/windows_ad_hidden_ou_creation.yml @@ -31,7 +31,9 @@ search: >- | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights') | search aceType IN ("Access denied",D) AND aceAccessRights IN ("List contents","List objects",LC,LO) | `windows_ad_hidden_ou_creation_filter` -how_to_implement: See link in references for how to configure logging for these eventcodes. Include lookups for SID resolution if evt_resolve_ad_obj is set to 0. +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. + See lantern article in references for further on how to onboard AD audit data. Ensure the + wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: None. references: - https://happycamper84.medium.com/sneaky-persistence-via-hidden-objects-in-ad-1c91fc37bf54 diff --git a/detections/application/windows_ad_object_owner_updated.yml b/detections/application/windows_ad_object_owner_updated.yml index 2d5118f931..3aca7ad031 100644 --- a/detections/application/windows_ad_object_owner_updated.yml +++ b/detections/application/windows_ad_object_owner_updated.yml @@ -24,7 +24,9 @@ search: ' `wineventlog_security` EventCode=5136 | eval user=coalesce(new_owner_user, new_owner_group, new_owner_group_builtin_group, new_owner), previousOwner=coalesce(old_owner_user, old_owner_group, old_owner_group_builtin_group, old_owner) | stats values(previousOwner) as previousOwner values(user) as user values(SubjectLogonId) as SubjectLogonId by _time ObjectClass ObjectDN src_user OpCorrelationID DSName | `windows_ad_object_owner_updated_filter`' -how_to_implement: This analytic leverages event code 5136, see documentation in references on how to enable logging. +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. + See lantern article in references for further on how to onboard AD audit data. Ensure the + wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: Unknown references: - https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings diff --git a/detections/application/windows_ad_self_dacl_assignment.yml b/detections/application/windows_ad_self_dacl_assignment.yml index e90a015ec8..25e3e509fa 100644 --- a/detections/application/windows_ad_self_dacl_assignment.yml +++ b/detections/application/windows_ad_self_dacl_assignment.yml @@ -33,7 +33,9 @@ search: >- | rex field=user "\\\(?P.*?)$" | where lower(src_user)=lower(nt_user) | `windows_ad_self_dacl_assignment_filter` -how_to_implement: Ensure you are ingesting AD audit logs, see lantern doc in references for further details. This detection also leverages admon data. Ensure the admon macro is configured with the correct index. +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. + See lantern article in references for further on how to onboard AD audit data. Ensure the + wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: Unknown references: - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory diff --git a/detections/application/windows_ad_suspicious_attribute_modification.yml b/detections/application/windows_ad_suspicious_attribute_modification.yml index e83a8b15ee..fc5baccb7f 100644 --- a/detections/application/windows_ad_suspicious_attribute_modification.yml +++ b/detections/application/windows_ad_suspicious_attribute_modification.yml @@ -7,8 +7,12 @@ status: production type: TTP data_source: - Windows Security 5136 -description: Suspicious AD Attribute Modification -search: ' `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName IN ("msDS-AllowedToDelegateTo","msDS-AllowedToActOnBehalfOfOtherIdentity","msDS-KeyCredentialLink","scriptPath","msTSInitialProgram") OperationType=%%14674 +description: >- + This detection monitors changes to the following Active Directory attributes: "msDS-AllowedToDelegateTo", "msDS-AllowedToActOnBehalfOfOtherIdentity", "msDS-KeyCredentialLink", "scriptPath", and "msTSInitialProgram". + Modifications to these attributes can indicate potential malicious activity or privilege escalation attempts. Immediate investigation is recommended upon alert. +search: >- + `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName IN ("msDS-AllowedToDelegateTo","msDS-AllowedToActOnBehalfOfOtherIdentity","scriptPath","msTSInitialProgram") OperationType=%%14674 + ```Changes to the attribute "msDS-KeyCredentialLink" are also worth moniroting, however tuning will need to be applied``` | table _time ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId DSName AttributeValue AttributeLDAPDisplayName | rename SubjectLogonId as TargetLogonId, src_user as initiator, _time as eventTime | appendpipe [| map search="search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$"] @@ -16,9 +20,11 @@ search: ' `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName IN ("ms | rex field=ObjectDN "^CN=(?P.*?),[A-Z]{2}\=" | eval dest=if(ObjectClass="computer",cn,null), user=if(ObjectClass="user",cn,null) | fields - cn - | `windows_ad_suspicious_attribute_modification_filter`' -how_to_implement: This analytic leverages event code 5136, see documentation in references on how to enable logging. -known_false_positives: Unknown + | `windows_ad_suspicious_attribute_modification_filter` +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. + See lantern article in references for further on how to onboard AD audit data. Ensure the + wineventlog_security macro is configured with the correct indexes. +known_false_positives: If key credentials are regularly assigned to users, these events will need to be tuned out. references: - https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory @@ -66,6 +72,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/DCShadowPermissions/windows-security-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/suspicious_acl_modification-windows-security-xml.log source: XmlWinEventLog:Security sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/application/windows_ad_suspicious_gpo_modification.yml b/detections/application/windows_ad_suspicious_gpo_modification.yml index a652ceb234..7abeb092eb 100644 --- a/detections/application/windows_ad_suspicious_gpo_modification.yml +++ b/detections/application/windows_ad_suspicious_gpo_modification.yml @@ -3,7 +3,7 @@ id: 0a2afc18-a3b5-4452-b60a-2e774214f9bf version: 1 date: '2023-12-19' author: Dean Luxton -status: production +status: experimental type: TTP data_source: - Windows Security 5136 @@ -11,28 +11,28 @@ data_source: description: This analytic looks for a the creation of potentially harmful GPO which could lead to persistence or code execution on remote hosts. Note, this analyic is looking for the absence of the corresponding 5136 events which is evidence of the GPOs being manually edited (using a tool like PowerView) or potentially missing logs. search: >- - `wineventlog_security` EventCode=5145 ShareName="\\\\*\\SYSVOL" RelativeTargetName IN (*\\ScheduledTasks.xml, *\\Groups.xml, *\\Registry.xml, *\\Services.xml, *\\Scripts\\*) NOT RelativeTargetName=*\\Scripts\\scripts.ini AccessMask=0x2 - | rex field=AccessList max_match=0 "(?P%%\d+)" - | table _time AccessMask src_ip src_user RelativeTargetName Logon_ID dvc - | rex field=RelativeTargetName "Policies\\\(?P{.*?})\\\(?P\w+?)\\\(\w+)\\\(?P\w+)\\\(?P\w+\.\w+)$" - | eval src=if(match(src_ip, "(?i)^fe80:"),dvc,src_ip), folder=case(RelativeTargetName like "%\\Scripts\\%","Scripts",folder="Groups","Local users and groups",1=1,folder) - | appendpipe - [| map search="search `wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=gPCMachineExtensionNames $gpo_guid$" - | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId - | rex field=old_value max_match=10000 "(?P\{.*?\})" - | rex field=new_value max_match=10000 "(?P\{.*?\})" - | rex field=ObjectDN max_match=10000 "CN=(?P\{.*?\})" - | mvexpand new_values - | where NOT new_values IN (old_values,"{00000000-0000-0000-0000-000000000000}",policy_guid) AND match(new_values, "^\{[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\}") - | lookup msad_guid_lookup guid as new_values OUTPUTNEW displayName as policyType - | eval newPolicy=if(policyType like "%",policyType,new_values) - | stats values(OpCorrelationID) as OpCorrelationID values(newPolicy) as newPolicy by ObjectDN - | rex field=ObjectDN max_match=10000 "CN=(?P\{.*?\})" - | fields - ObjectDN] - | stats values(AccessMask) as AccessMask values(src) as src values(src_user) as src_user values(RelativeTargetName) as RelativeTargetName values(Logon_ID) as Logon_ID values(newPolicy) as newPolicy values(OpCorrelationID) as OpCorrelationID values(folder) as folder values(file) as file by gpo_guid - | mvexpand folder - | where NOT folder IN (newPolicy) - | `windows_ad_suspicious_gpo_modification_filter` + `wineventlog_security` EventCode=5145 ShareName="\\\\*\\SYSVOL" RelativeTargetName IN (*\\ScheduledTasks.xml, *\\Groups.xml, *\\Registry.xml, *\\Services.xml, *\\Scripts\\*) NOT RelativeTargetName=*\\Scripts\\scripts.ini AccessMask=0x2 + | rex field=AccessList max_match=0 "(?P%%\d+)" + | table _time AccessMask src_ip src_user RelativeTargetName Logon_ID dvc + | rex field=RelativeTargetName "Policies\\\(?P{.*?})\\\(?P\w+?)\\\(\w+)\\\(?P\w+)\\\(?P\w+\.\w+)$" + | eval src=if(match(src_ip, "(?i)^fe80:"),dvc,src_ip), folder=case(RelativeTargetName like "%\\Scripts\\%","Scripts",folder="Groups","Local users and groups",1=1,folder) + | appendpipe + [| map search="search `wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=gPCMachineExtensionNames $gpo_guid$" + | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId + | rex field=old_value max_match=10000 "(?P\{.*?\})" + | rex field=new_value max_match=10000 "(?P\{.*?\})" + | rex field=ObjectDN max_match=10000 "CN=(?P\{.*?\})" + | mvexpand new_values + | where NOT new_values IN (old_values,"{00000000-0000-0000-0000-000000000000}",policy_guid) AND match(new_values, "^\{[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\}") + | lookup msad_guid_lookup guid as new_values OUTPUTNEW displayName as policyType + | eval newPolicy=if(policyType like "%",policyType,new_values) + | stats values(OpCorrelationID) as OpCorrelationID values(newPolicy) as newPolicy by ObjectDN + | rex field=ObjectDN max_match=10000 "CN=(?P\{.*?\})" + | fields - ObjectDN] + | stats values(AccessMask) as AccessMask values(src) as src values(src_user) as src_user values(RelativeTargetName) as RelativeTargetName values(Logon_ID) as Logon_ID values(newPolicy) as newPolicy values(OpCorrelationID) as OpCorrelationID values(folder) as folder values(file) as file by gpo_guid + | mvexpand folder + | where NOT folder IN (newPolicy) + | `windows_ad_suspicious_gpo_modification_filter` how_to_implement: Ingest EventCodes 5145 and 5136 from domain controllers. Additional SACLs required to capture EventCode 5136, see references for further information on how to configure this. The Group Policy - Audit Detailed File Share will need to be enabled on the DCs to generate event code 5145, this event is very noisy on DCs, consider tuning out sysvol events which do not match access mask 0x2. known_false_positives: When a GPO is manually edited and 5136 events are not logging to Splunk. @@ -47,7 +47,7 @@ tags: analytic_story: - Sneaky Active Directory Persistence Tricks asset_type: Endpoint - confidence: 100 + confidence: 80 impact: 100 message: $src_user$ has added new GPO Client Side Extensions $folder$ to the policy $gpo_guid$ mitre_attack_id: @@ -68,7 +68,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 100 + risk_score: 80 required_fields: - _time - OperationType @@ -84,6 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_created/gpo_new_cse_windows-security-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/gpo_new_cse/windows-security.log source: XmlWinEventLog:Security sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml index 3a5b2007de..a7e217a4ce 100644 --- a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml +++ b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml @@ -1,7 +1,7 @@ name: Windows AD Domain Replication ACL Addition id: 8c372853-f459-4995-afdc-280c114d33ab -version: 3 -date: "2024-07-02" +version: 4 +date: "2024-08-08" author: Dean Luxton type: TTP status: production From 19d9e49a38552db8382318cf8d45f42f586efbb7 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Fri, 16 Aug 2024 16:06:31 +1000 Subject: [PATCH 14/15] fixing copy pasta error --- .../endpoint/windows_network_share_interaction_with_net.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_network_share_interaction_with_net.yml b/detections/endpoint/windows_network_share_interaction_with_net.yml index 057b77623e..79d3cfb792 100644 --- a/detections/endpoint/windows_network_share_interaction_with_net.yml +++ b/detections/endpoint/windows_network_share_interaction_with_net.yml @@ -12,7 +12,7 @@ description: This analytic detects network share discovery and collection activi which can be a precursor to privilege escalation or data exfiltration. By monitoring Windows Event Logs for the usage of the Net command to list and interact with network shares, this detection helps identify potential reconnaissance and collection activities. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.user_category) as user_category values(Processes.user_bunit) as user_bunit FROM datamodel=Endpoint.Processes WHERE (Processes.process_name="net.exe" OR Processes.process_name="net1.exe" OR Processes.orig_process_name="net.exe" OR Processes.orig_process_name="net1net[\s\.ex1]+view|net[\s\.ex1]+share|net[\s\.ex1]+use\s.exe") BY Processes.user Processes.dest Processes.process_exec Processes.parent_process_exec +search: '| tstats `security_con tent_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.user_category) as user_category values(Processes.user_bunit) as user_bunit FROM datamodel=Endpoint.Processes WHERE (Processes.process_name="net.exe" OR Processes.process_name="net1.exe" OR Processes.orig_process_name="net.exe" OR Processes.orig_process_name="net1.exe") BY Processes.user Processes.dest Processes.process_exec Processes.parent_process_exec Processes.process Processes.parent_process | `drop_dm_object_name(Processes)` | regex process="net[\s\.ex1]+view|net[\s\.ex1]+share|net[\s\.ex1]+use\s" From 68c44c76a902d128c0b389ab79bda69ccbd68c74 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 19 Aug 2024 13:53:39 +0530 Subject: [PATCH 15/15] updating observables --- detections/application/windows_ad_gpo_new_cse_addition.yml | 4 ---- .../windows_ad_suspicious_attribute_modification.yml | 4 ---- .../endpoint/windows_network_share_interaction_with_net.yml | 2 +- 3 files changed, 1 insertion(+), 9 deletions(-) diff --git a/detections/application/windows_ad_gpo_new_cse_addition.yml b/detections/application/windows_ad_gpo_new_cse_addition.yml index 7560e91b43..7404ec85a7 100644 --- a/detections/application/windows_ad_gpo_new_cse_addition.yml +++ b/detections/application/windows_ad_gpo_new_cse_addition.yml @@ -42,10 +42,6 @@ tags: - T1222 - T1222.001 observable: - - name: user - type: User - role: - - Victim - name: src_user type: User role: diff --git a/detections/application/windows_ad_suspicious_attribute_modification.yml b/detections/application/windows_ad_suspicious_attribute_modification.yml index fc5baccb7f..f006dae853 100644 --- a/detections/application/windows_ad_suspicious_attribute_modification.yml +++ b/detections/application/windows_ad_suspicious_attribute_modification.yml @@ -40,10 +40,6 @@ tags: - T1222 - T1222.001 observable: - - name: user - type: User - role: - - Victim - name: src_user type: User role: diff --git a/detections/endpoint/windows_network_share_interaction_with_net.yml b/detections/endpoint/windows_network_share_interaction_with_net.yml index 79d3cfb792..638661e1ca 100644 --- a/detections/endpoint/windows_network_share_interaction_with_net.yml +++ b/detections/endpoint/windows_network_share_interaction_with_net.yml @@ -12,7 +12,7 @@ description: This analytic detects network share discovery and collection activi which can be a precursor to privilege escalation or data exfiltration. By monitoring Windows Event Logs for the usage of the Net command to list and interact with network shares, this detection helps identify potential reconnaissance and collection activities. -search: '| tstats `security_con tent_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.user_category) as user_category values(Processes.user_bunit) as user_bunit FROM datamodel=Endpoint.Processes WHERE (Processes.process_name="net.exe" OR Processes.process_name="net1.exe" OR Processes.orig_process_name="net.exe" OR Processes.orig_process_name="net1.exe") BY Processes.user Processes.dest Processes.process_exec Processes.parent_process_exec +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.user_category) as user_category values(Processes.user_bunit) as user_bunit FROM datamodel=Endpoint.Processes WHERE (Processes.process_name="net.exe" OR Processes.process_name="net1.exe" OR Processes.orig_process_name="net.exe" OR Processes.orig_process_name="net1.exe") BY Processes.user Processes.dest Processes.process_exec Processes.parent_process_exec Processes.process Processes.parent_process | `drop_dm_object_name(Processes)` | regex process="net[\s\.ex1]+view|net[\s\.ex1]+share|net[\s\.ex1]+use\s"