From 74938e42a5fe7b00a977dc8a1285b959ff1d0c8a Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 24 Apr 2023 13:45:28 -0400 Subject: [PATCH] adding new detection. updating message on others --- ...n_default_group_policy_object_modified.yml | 2 +- ...dows_admon_group_policy_object_created.yml | 2 +- ...s_default_group_policy_object_modified.yml | 2 +- ...group_policy_object_modified_with_gpme.yml | 82 +++++++++++++++++++ .../windows_dnsadmins_new_member_added.yml | 2 +- .../windows_group_policy_object_created.yml | 2 +- ..._of_computer_service_tickets_requested.yml | 4 +- ...rapid_authentication_on_multiple_hosts.yml | 2 +- ...ial_privileged_logon_on_multiple_hosts.yml | 2 +- ..._policy_object_modified_with_gpme.test.yml | 13 +++ 10 files changed, 104 insertions(+), 9 deletions(-) create mode 100644 detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml create mode 100644 tests/endpoint/windows_default_group_policy_object_modified_with_gpme.test.yml diff --git a/detections/endpoint/windows_admon_default_group_policy_object_modified.yml b/detections/endpoint/windows_admon_default_group_policy_object_modified.yml index 8a1715f39a..8f96b6cea2 100644 --- a/detections/endpoint/windows_admon_default_group_policy_object_modified.yml +++ b/detections/endpoint/windows_admon_default_group_policy_object_modified.yml @@ -43,7 +43,7 @@ tags: kill_chain_phases: - Installation - Actions on Objectives - message: UPDATE message + message: A default domain group policy was updated on $dcName$ mitre_attack_id: - T1484 - T1484.001 diff --git a/detections/endpoint/windows_admon_group_policy_object_created.yml b/detections/endpoint/windows_admon_group_policy_object_created.yml index a432ffcbf9..07cd40ef47 100644 --- a/detections/endpoint/windows_admon_group_policy_object_created.yml +++ b/detections/endpoint/windows_admon_group_policy_object_created.yml @@ -43,7 +43,7 @@ tags: kill_chain_phases: - Installation - Actions on Objectives - message: UPDATE message + message: A new group policy objected was created on $dcName$ mitre_attack_id: - T1484 - T1484.001 diff --git a/detections/endpoint/windows_default_group_policy_object_modified.yml b/detections/endpoint/windows_default_group_policy_object_modified.yml index aba6fd7e8c..ca717775c1 100644 --- a/detections/endpoint/windows_default_group_policy_object_modified.yml +++ b/detections/endpoint/windows_default_group_policy_object_modified.yml @@ -44,7 +44,7 @@ tags: kill_chain_phases: - Installation - Actions on Objectives - message: UPDATE message + message: A default group policy object was modified on $Computer$ by $SubjectUserSid$ mitre_attack_id: - T1484 - T1484.001 diff --git a/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml b/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml new file mode 100644 index 0000000000..0f8f00513f --- /dev/null +++ b/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml @@ -0,0 +1,82 @@ +name: Windows Default Group Policy Object Modified with GPME +id: eaf688b3-bb8f-454d-b105-920a862cd8cb +version: 1 +date: '2023-04-24' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic leverages the Endpoint datamodel to identify the potential edition of a default Group Policy Object. A fresh installation of an Active Directory network will typically contain + two default group policy objects `Default Domain Controllers Policy` and `Default Domain Policy`. The default domain controllers policy is used to enforce and set policies to all the domain controllers within the domain environment. + The default domain policy is linked to all users and computers by default. An adversary who has obtained privileged access to an Active Directory network may modify the default group + policy objects to obtain further access, deploy persistence or execute malware across a large number of hosts. Security teams should monitor the edition of the default GPOs. +search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mmc.exe (Processes.process =*gpme.msc*) AND (Processes.process = "*31B2F340-016D-11D2-945F-00C04FB984F9*" OR Processes.process = "*6AC1786C-016F-11D2-945F-00C04fB984F9*" ) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_default_group_policy_object_modified_with_gpme_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: The default Group Policy Objects within an AD network may be legitimately updated for administrative operations, filter as needed. +references: +- https://attack.mitre.org/techniques/T1484/ +- https://attack.mitre.org/techniques/T1484/001 +- https://www.trustedsec.com/blog/weaponizing-group-policy-objects-access/ +- https://adsecurity.org/?p=2716 +- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn265969(v=ws.11) +tags: + analytic_story: + - Active Directory Privilege Escalation + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/default_domain_policy_modified/windows-security.log + impact: 100 + kill_chain_phases: + - Installation + - Actions on Objectives + message: A default group policy object was opened with Group Policy Manage Editor on $dest$ + mitre_attack_id: + - T1484 + - T1484.001 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 50 + security_domain: endpoint diff --git a/detections/endpoint/windows_dnsadmins_new_member_added.yml b/detections/endpoint/windows_dnsadmins_new_member_added.yml index cba07ff4b1..7fcb8fc9cf 100644 --- a/detections/endpoint/windows_dnsadmins_new_member_added.yml +++ b/detections/endpoint/windows_dnsadmins_new_member_added.yml @@ -39,7 +39,7 @@ tags: kill_chain_phases: - Installation - Actions on Objectives - message: UPDATE message + message: A new member was added to the DnsAdmins group by $SubjectUserName$ mitre_attack_id: - T1098 nist: diff --git a/detections/endpoint/windows_group_policy_object_created.yml b/detections/endpoint/windows_group_policy_object_created.yml index 00ae701cff..b373f2d85a 100644 --- a/detections/endpoint/windows_group_policy_object_created.yml +++ b/detections/endpoint/windows_group_policy_object_created.yml @@ -47,7 +47,7 @@ tags: - Exploitation - Installation - Actions on Objectives - message: UPDATE message + message: A new group policy objected was created by $User$ mitre_attack_id: - T1484 - T1484.001 diff --git a/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml b/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml index b9934efdf2..c34827bf9c 100644 --- a/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml +++ b/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml @@ -17,7 +17,7 @@ description: The following analytic leverages Event ID 4769, `A Kerberos the arbitrary threshold as needed. search: ' `wineventlog_security` EventCode=4769 ServiceName="*$" TargetUserName!="*$" - | bucket span=2m _time + | bucket span=5m _time | stats dc(ServiceName) AS unique_targets values(ServiceName) as host_targets by _time, IpAddress, TargetUserName | where unique_targets > 30 | `windows_large_number_of_computer_service_tickets_requested_filter`' @@ -48,7 +48,7 @@ tags: impact: 60 kill_chain_phases: - Reconnaissance - message: UPDATE message + message: A large number of kerberos computer service tickets were requested by $IpAddress$ within 5 minutes. mitre_attack_id: - T1135 - T1078 diff --git a/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml b/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml index c91f21ecef..e05150d85d 100644 --- a/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml +++ b/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml @@ -42,7 +42,7 @@ tags: impact: 60 kill_chain_phases: - Exploitation - message: UPDATE message + message: The source computer with ip address $IpAddress$ authenticated to a large number of remote endpoints within 5 minutes. mitre_attack_id: - T1003.002 nist: diff --git a/detections/endpoint/windows_special_privileged_logon_on_multiple_hosts.yml b/detections/endpoint/windows_special_privileged_logon_on_multiple_hosts.yml index 8b2262dc5a..71fd7c49d4 100644 --- a/detections/endpoint/windows_special_privileged_logon_on_multiple_hosts.yml +++ b/detections/endpoint/windows_special_privileged_logon_on_multiple_hosts.yml @@ -43,7 +43,7 @@ tags: kill_chain_phases: - Reconnaissance - Exploitation - message: UPDATE message + message: A source user $Caller_User_Name$ obtained special privileges on a large number of endpoints within 5 minutes. mitre_attack_id: - T1087 - T1021.002 diff --git a/tests/endpoint/windows_default_group_policy_object_modified_with_gpme.test.yml b/tests/endpoint/windows_default_group_policy_object_modified_with_gpme.test.yml new file mode 100644 index 0000000000..f105615cdb --- /dev/null +++ b/tests/endpoint/windows_default_group_policy_object_modified_with_gpme.test.yml @@ -0,0 +1,13 @@ +name: Windows Default Group Policy Object Modified with GPME Unit Test +tests: +- name: Windows Default Group Policy Object Modified with GPME + file: endpoint/windows_default_group_policy_object_modified_with_gpme.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/default_domain_policy_modified/windows-security.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true