From 6ae65351f551cb99d75fc0d7513bb720dfea0f64 Mon Sep 17 00:00:00 2001
From: dluxtron <106139814+dluxtron@users.noreply.github.com>
Date: Fri, 2 Sep 2022 13:01:05 +1000
Subject: [PATCH] Adding DCShadow detection

---
 detections/endpoint/dcshadow_attack.yml | 83 +++++++++++++++++++++++++
 tests/endpoint/dcshadow_attack.test.yml | 13 ++++
 2 files changed, 96 insertions(+)
 create mode 100644 detections/endpoint/dcshadow_attack.yml
 create mode 100644 tests/endpoint/dcshadow_attack.test.yml

diff --git a/detections/endpoint/dcshadow_attack.yml b/detections/endpoint/dcshadow_attack.yml
new file mode 100644
index 0000000000..e89ae20644
--- /dev/null
+++ b/detections/endpoint/dcshadow_attack.yml
@@ -0,0 +1,83 @@
+name: DCShadow Attack
+id: b500b64d-5330-4c92-9581-e4c3f0728621
+version: 1
+date: '2022-09-02'
+author: Dean Luxton
+type: TTP
+datamodel: []
+description: DCshadow is a Post Exploitation attack added to Mimikatz in 2018. The DCShadow attack requires domain admin privileges or equivalent. The attack works by temporarily assuming the role of a domain controller and pushing replication changes to the domain. No event logs are written for changes to AD attributes, allowing for stealthy backdoors to be implanted in the domain, or metadata such as timestamps overwritten to cover tracks. 
+search: "```XML-Wineventlog Detection```\n`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName\
+  \ (AttributeValue=\"GC/*\" OR AttributeValue=\"E3514235-4B06-11D1-AB04-00C04FC2DCD2/*\"\
+  )\n| replace \"%%14674\" with \"Value Added\", \"%%14675\" with \"Value Deleted\"\
+  \ in OperationType\n| stats min(_time) as firstEvent max(_time) as latestEvent values(OperationType)\
+  \ as Action range(_time) as duration by src_nt_domain, src_user, Computer, ObjectDN,\
+  \ Logon_ID, signature\n| where mvcount(Action) >1 \n| join type=outer Logon_ID [|\
+  \ search `wineventlog_security` EventCode=4624  | rename TargetLogonId as Logon_ID\
+  \ src_ip as src]\n| table firstEvent, latestEvent, duration, src_nt_domain, src_user,\
+  \ Computer, ObjectDN, Action, signature, src, Logon_ID\n| eval firstEvent=strftime(firstEvent,\
+  \ \"%Y-%m-%d %H:%M:%S\"), latestEvent=strftime(latestEvent, \"%Y-%m-%d %H:%M:%S\"\
+  )\n\n```Non-XML Wineventlog Detection\n`wineventlog_security` EventCode=5136 LDAP_Display_Name=servicePrincipalName\n\
+  (Value=\"*GC/*\" OR Value=\"*E3514235-4B06-11D1-AB04-00C04FC2DCD2/*\")\n| stats\
+  \ min(_time) as firstEvent max(_time) as latestEvent values(eval(mvfilter(match(Type,\"\
+  Value\")))) as Action range(_time) as duration by Account_Domain, Account_Name,\
+  \ ComputerName, DN, Logon_ID, signature\n| where mvcount(Action) >1 \n| join type=outer\
+  \ Logon_ID [| search index=win EventCode=4624 | eval Logon_ID=if(mvcount(Logon_ID)>1,mvindex(Logon_ID,1),'Logon_ID'),\
+  \ Account_Domain=if(mvcount(Account_Domain)>1,mvindex(Account_Domain,1),'Account_Domain'),\
+  \ Account_Name=if(mvcount(Account_Name)>1,mvindex(Account_Name,1),'Account_Name')]\n\
+  | table firstEvent, latestEvent, duration, Account_Domain, Account_Name, ComputerName,\
+  \ DN, Action, signature, status, src, Logon_ID, Logon_GUID\n| eval firstEvent=strftime(firstEvent,\
+  \ \"%Y-%m-%d %H:%M:%S\"), latestEvent=strftime(latestEvent, \"%Y-%m-%d %H:%M:%S\"\
+  )``` | `dcshadow_attack_filter`"
+how_to_implement: To successfully implement this search, you need to be ingesting eventcode 5136. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled, alongside a SACL for `everybody` to  `Write All Properties` applied to the domain root and all descendant objects.
+known_false_positives: None.
+references:
+- https://www.dcshadow.com/
+- https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2
+tags:
+  analytic_story:
+  - Domain Controller Attacks
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  context:
+    - Source:Endpoint
+    - Stage:Actions on Objectives
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1207/mimikatz/windows-security-xml.log
+  impact: 100
+  kill_chain_phases:
+  - Actions on Objectives
+  message: DCShadow Attack Detected from $src$
+  mitre_attack_id:
+  - T1207
+  nist:
+  - DE.CM
+  observable:
+  - name: src_user
+    type: User
+    role:
+    - Victim
+  - name: src
+    type: IP
+    role:
+    - Attacker
+product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - AttributeLDAPDisplayName
+  - AttributeValue
+  - src_nt_domain
+  - src_user
+  - Computer
+  - ObjectDN
+  - Logon_ID
+  - signature
+  risk_score: 100
+  security_domain: endpoint
diff --git a/tests/endpoint/dcshadow_attack.test.yml b/tests/endpoint/dcshadow_attack.test.yml
new file mode 100644
index 0000000000..04c3d4f9d4
--- /dev/null
+++ b/tests/endpoint/dcshadow_attack.test.yml
@@ -0,0 +1,13 @@
+name: DCShadow Attack Unit Test
+tests:
+- name: DCShadow Attack
+  file: endpoint/dcshadow_attack.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: UPDATE
+    data: UPDATE
+    source: UPDATE
+    sourcetype: UPDATE
+    update_timestamp: true