admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

improving detection

Browse Source
This commit is contained in:
mvelazco
2022-11-17 18:35:11 -05:00
parent 6875fad053
commit 651426899d
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_ad_adminsdholder_acl_modified.yml
+2 -1
View File
@@ -12,7 +12,8 @@ description: The following analytic identifies the modification of the Access Co
Access Control List (ACL) with the security permissions set on the AdminSDHolder. An adversary who has obtained privileged access to a Windows Domain may modify the AdminSDHolder
ACL to establish persistence and allow an unprivileged user to take control of a domain.
search: ' `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=nTSecurityDescriptor OperationType="%%14674" ObjectDN="CN=AdminSDHolder,CN=System*"
| stats values(ObjectDN) by _time, Computer, SubjectUserName, AttributeValue
| rex field=AttributeValue max_match=10000 "A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;(?P<added_user_sid>S-1-[0-59]-\d{2}-\d{8,10}-\d{8,10}-\d{8,10}-[1-9]\d{3})\)"
| stats values(added_user_sid) by _time, Computer, SubjectUserName, ObjectDN
| `windows_ad_adminsdholder_acl_modified_filter`'
how_to_implement: To successfully implement this search, you ned to be ingesting eventcode
`5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes`