Adding DCShadow detection

detections/endpoint/dcshadow_attack.yml

@@ -0,0 +1,83 @@
+name: DCShadow Attack
+id: b500b64d-5330-4c92-9581-e4c3f0728621
+version: 1
+date: '2022-09-02'
+author: Dean Luxton
+type: TTP
+datamodel: []
+description: DCshadow is a Post Exploitation attack added to Mimikatz in 2018. The DCShadow attack requires domain admin privileges or equivalent. The attack works by temporarily assuming the role of a domain controller and pushing replication changes to the domain. No event logs are written for changes to AD attributes, allowing for stealthy backdoors to be implanted in the domain, or metadata such as timestamps overwritten to cover tracks. 
+search: "```XML-Wineventlog Detection```\n`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName\
+  \ (AttributeValue=\"GC/*\" OR AttributeValue=\"E3514235-4B06-11D1-AB04-00C04FC2DCD2/*\"\
+  )\n| replace \"%%14674\" with \"Value Added\", \"%%14675\" with \"Value Deleted\"\
+  \ in OperationType\n| stats min(_time) as firstEvent max(_time) as latestEvent values(OperationType)\
+  \ as Action range(_time) as duration by src_nt_domain, src_user, Computer, ObjectDN,\
+  \ Logon_ID, signature\n| where mvcount(Action) >1 \n| join type=outer Logon_ID [|\
+  \ search `wineventlog_security` EventCode=4624  | rename TargetLogonId as Logon_ID\
+  \ src_ip as src]\n| table firstEvent, latestEvent, duration, src_nt_domain, src_user,\
+  \ Computer, ObjectDN, Action, signature, src, Logon_ID\n| eval firstEvent=strftime(firstEvent,\
+  \ \"%Y-%m-%d %H:%M:%S\"), latestEvent=strftime(latestEvent, \"%Y-%m-%d %H:%M:%S\"\
+  )\n\n```Non-XML Wineventlog Detection\n`wineventlog_security` EventCode=5136 LDAP_Display_Name=servicePrincipalName\n\
+  (Value=\"*GC/*\" OR Value=\"*E3514235-4B06-11D1-AB04-00C04FC2DCD2/*\")\n| stats\
+  \ min(_time) as firstEvent max(_time) as latestEvent values(eval(mvfilter(match(Type,\"\
+  Value\")))) as Action range(_time) as duration by Account_Domain, Account_Name,\
+  \ ComputerName, DN, Logon_ID, signature\n| where mvcount(Action) >1 \n| join type=outer\
+  \ Logon_ID [| search index=win EventCode=4624 | eval Logon_ID=if(mvcount(Logon_ID)>1,mvindex(Logon_ID,1),'Logon_ID'),\
+  \ Account_Domain=if(mvcount(Account_Domain)>1,mvindex(Account_Domain,1),'Account_Domain'),\
+  \ Account_Name=if(mvcount(Account_Name)>1,mvindex(Account_Name,1),'Account_Name')]\n\
+  | table firstEvent, latestEvent, duration, Account_Domain, Account_Name, ComputerName,\
+  \ DN, Action, signature, status, src, Logon_ID, Logon_GUID\n| eval firstEvent=strftime(firstEvent,\
+  \ \"%Y-%m-%d %H:%M:%S\"), latestEvent=strftime(latestEvent, \"%Y-%m-%d %H:%M:%S\"\
+  )``` | `dcshadow_attack_filter`"
+how_to_implement: To successfully implement this search, you need to be ingesting eventcode 5136. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled, alongside a SACL for `everybody` to  `Write All Properties` applied to the domain root and all descendant objects.
+known_false_positives: None.
+references:
+- https://www.dcshadow.com/
+- https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2
+tags:
+  analytic_story:
+  - Domain Controller Attacks
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  context:
+    - Source:Endpoint
+    - Stage:Actions on Objectives
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1207/mimikatz/windows-security-xml.log
+  impact: 100
+  kill_chain_phases:
+  - Actions on Objectives
+  message: DCShadow Attack Detected from $src$
+  mitre_attack_id:
+  - T1207
+  nist:
+  - DE.CM
+  observable:
+  - name: src_user
+    type: User
+    role:
+    - Victim
+  - name: src
+    type: IP
+    role:
+    - Attacker
+product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - AttributeLDAPDisplayName
+  - AttributeValue
+  - src_nt_domain
+  - src_user
+  - Computer
+  - ObjectDN
+  - Logon_ID
+  - signature
+  risk_score: 100
+  security_domain: endpoint

tests/endpoint/dcshadow_attack.test.yml

@@ -0,0 +1,13 @@
+name: DCShadow Attack Unit Test
+tests:
+- name: DCShadow Attack
+  file: endpoint/dcshadow_attack.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: UPDATE
+    data: UPDATE
+    source: UPDATE
+    sourcetype: UPDATE
+    update_timestamp: true