From 4d91dcbe0fd81497c9853e4f9e67fc47cc31effd Mon Sep 17 00:00:00 2001 From: root Date: Tue, 31 Aug 2021 10:15:36 +0000 Subject: [PATCH] Added detection testing service results inGet ADUserResultantPasswordPolicy with Powershell Script Block --- ...ordpolicy_with_powershell_script_block.yml | 33 ++++++++++--------- 1 file changed, 17 insertions(+), 16 deletions(-) diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml index 216df909e3..6dd5fd9fbb 100644 --- a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml +++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml @@ -6,18 +6,18 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy. - This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially - in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or - credential dumping as post attack. -search: '`powershell` EventCode=4104 Message ="*Get-ADUserResultantPasswordPolicy*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy. + This command can be used by attacker to mapped all password policy in a target host. + This command may cause some noise especially in admin user that can execute this + for policy audit. This hunting query is a good pivot to start investigating possible + lateral movement or credential dumping as post attack. +search: '`powershell` EventCode=4104 Message ="*Get-ADUserResultantPasswordPolicy*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message + ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_aduserresultantpasswordpolicy_with_powershell_script_block_filter`' -how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. - Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, - or PowerShell Script Block Logging. +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. known_false_positives: network operator may use this command references: - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet @@ -37,18 +37,18 @@ tags: required_fields: - _time - EventCode - - Message - - ComputerName + - Message + - ComputerName - User security_domain: endpoint impact: 30 confidence: 30 - # (impact * confidence)/100 risk_score: 9 context: - source:endpoint - stage:Reconnaissance - message: powershell process having commandline $Message$ to query domain user password policy. + message: powershell process having commandline $Message$ to query domain user password + policy. observable: - name: ComputerName type: Hostname @@ -57,4 +57,5 @@ tags: - name: User type: User role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed