admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'AD_Discovery_TR-789_6' of github.com:splunk/security_content into AD_Discovery_TR-789_6

Browse Source
This commit is contained in:
mvelazco
2021-09-10 12:34:20 -04:00
parent 3fcdb20c51 cb381af6ba
commit 356bd8eba6
1 changed files with 14 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/elevated_group_discovery_with_powerview.yml
+14 -9
View File
@@ -7,13 +7,17 @@ type: Hunting
datamodel:
- Endpoint
description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
to identify the execution of the `Get-DomainGroupMember` commandlet. `Get-DomainGroupMember` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains.
As the name suggests, `Get-DomainGroupMember` is used to list the members of an specific domain group.
Red Teams and adversaries alike use PowerView to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users.
search: '`powershell` EventCode=4104 (Message = "*Get-DomainGroupMember*")
AND Message IN ("*Domain Admins*","*Enterprise Admins*", "*Schema Admins*", "*Account Operators*" , "*Server Operators*", "*Protected Users*", "*Dns Admins*")
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
ComputerName User | `security_content_ctime(firstTime)` | `elevated_group_discovery_with_powerview_filter`'
to identify the execution of the `Get-DomainGroupMember` commandlet. `Get-DomainGroupMember`
is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains.
As the name suggests, `Get-DomainGroupMember` is used to list the members of an
specific domain group. Red Teams and adversaries alike use PowerView to enumerate
elevated domain groups for situational awareness and Active Directory Discovery
to identify high privileged users.
search: '`powershell` EventCode=4104 (Message = "*Get-DomainGroupMember*") AND Message
IN ("*Domain Admins*","*Enterprise Admins*", "*Schema Admins*", "*Account Operators*"
, "*Server Operators*", "*Protected Users*", "*Dns Admins*") | stats count min(_time)
as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
| `elevated_group_discovery_with_powerview_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -22,7 +26,7 @@ references:
- https://attack.mitre.org/techniques/T1069/002/
- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroupMember/
- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory
- https://attack.mitre.org/techniques/T1069/002/
- https://attack.mitre.org/techniques/T1069/002/
tags:
analytic_story:
- Active Directory Discovery
@@ -51,4 +55,5 @@ tags:
- name: dest
type: Endpoint
role:
- Victim
- Victim
automated_detection_testing: passed