Adding detection, updating detections

detections/application/windows_ad_suspicious_gpo_modification.yml

@@ -0,0 +1,88 @@
+name: Windows AD Suspicious GPO Modification
+id: 0a2afc18-a3b5-4452-b60a-2e774214f9bf
+version: 1
+date: '2023-12-19'
+author: Dean Luxton
+status: production
+type: TTP
+data_source:
+- Windows Security 5136
+- Windows Security 5145
+description: This analytic looks for a the creation of potentially harmful GPO which could lead to persistence or code execution on remote hosts. 
+  Note, this analyic is looking for the absence of the corresponding 5136 events which is evidence of the GPOs being manually created (using a tool like PowerView) or potentially missing logs. 
+search: '`wineventlog_security` EventCode=5145 ShareName="\\\\*\\SYSVOL" RelativeTargetName IN (*\\ScheduledTasks.xml, *\\Groups.xml, *\\Registry.xml, *\\Services.xml, *\\Scripts\\*) NOT RelativeTargetName=*\\Scripts\\scripts.ini AccessMask=0x2 
+ | rex field=AccessList max_match=0 "(?P<AccessList>%%\d+)" 
+ | table _time AccessMask src_ip src_user RelativeTargetName Logon_ID dvc 
+ | rex field=RelativeTargetName "Policies\\\(?P<gpo_guid>{.*?})\\\(?P<scope>\w+?)\\\(\w+)\\\(?P<folder>\w+)\\\(?P<file>\w+\.\w+)$"
+ | eval src=if(match(src_ip, "(?i)^fe80:"),dvc,src_ip), folder=case(RelativeTargetName like "%\\Scripts\\%","Scripts",folder="Groups","Local users and groups",1=1,folder)
+ | appendpipe 
+     [| map search="search `wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=gPCMachineExtensionNames $gpo_guid$" 
+     | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId 
+     | rex field=old_value max_match=10000 "(?P<old_values>\{.*?\})" 
+     | rex field=new_value max_match=10000 "(?P<new_values>\{.*?\})" 
+     | rex field=ObjectDN max_match=10000 "CN=(?P<policy_guid>\{.*?\})" 
+     | mvexpand new_values 
+     | where NOT new_values IN (old_values,"{00000000-0000-0000-0000-000000000000}",policy_guid) AND match(new_values, "^\{[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\}") 
+     | lookup msad_guid_lookup.csv guid as new_values OUTPUTNEW displayName as policyType 
+     | eval newPolicy=if(policyType like "%",policyType,new_values) 
+     | stats values(OpCorrelationID) as OpCorrelationID values(newPolicy) as newPolicy by ObjectDN 
+     | rex field=ObjectDN max_match=10000 "CN=(?P<gpo_guid>\{.*?\})" 
+     | fields - ObjectDN] 
+ | stats values(AccessMask) as AccessMask values(src) as src values(src_user) as src_user values(RelativeTargetName) as RelativeTargetName values(Logon_ID) as Logon_ID values(newPolicy) as newPolicy values(OpCorrelationID) as OpCorrelationID values(folder) as folder values(file) as file by gpo_guid 
+ | mvexpand folder 
+ | where NOT folder IN (newPolicy)
+ | `windows_ad_suspicious_gpo_modification_filter`'
+how_to_implement: Ingest EventCodes 5145 and 5136 from domain controllers. Additional SACLs required to capture EventCode 5136, see references for further information on how to configure this. 
+  The Group Policy - Audit Detailed File Share will need to be enabled on the DCs to generate event code 5145, this event is very noisy on DCs, consider tuning out sysvol events which do not match access mask 0x2.
+known_false_positives: When a GPO is manually created and there are no 5136 events. 
+references:
+- https://github.com/PowerShellMafia/PowerSploit/blob/26a0757612e5654b4f792b012ab8f10f95d391c9/Recon/PowerView.ps1#L5907-L6122
+- https://github.com/X-C3LL/GPOwned
+- https://rastamouse.me/ous-and-gpos-and-wmi-filters-oh-my/
+- https://wald0.com/?p=179
+- https://github.com/FSecureLABS/SharpGPOAbuse
+- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
+tags:
+  analytic_story:
+    - Sneaky Active Directory Persistence Tricks
+  asset_type: Endpoint
+  confidence: 100
+  impact: 100
+  message: $src_user$ has added new GPO Client Side Extensions $newPolicy$ to the policy $policyName$
+  mitre_attack_id:
+  - T1484
+  - T1484.001
+  - T1222
+  - T1222.001
+  observable:
+    - name: user
+      type: User
+      role:
+        - Victim
+    - name: src_user
+      type: User
+      role:
+        - Victim
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  risk_score: 100
+  required_fields:
+    - _time
+    - OperationType
+    - ObjectDN
+    - OpCorrelationID
+    - src_user
+    - AttributeLDAPDisplayName
+    - AttributeValue
+    - ObjectClass
+    - SubjectLogonId
+    - DSName
+  security_domain: endpoint
+tests:
+  - name: True Positive Test
+    attack_data:
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_created/gpo_new_cse_windows-security-xml.log
+        source: XmlWinEventLog:Security
+        sourcetype: xmlwineventlog

detections/endpoint/windows_admon_group_policy_object_created.yml

@@ -13,7 +13,7 @@ description: The following analytic leverages Splunks Admon to identify the crea
 search: ' `admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*" versionNumber=0 displayName!="New Group Policy Object"
   | appendpipe [
   | map search="search `wineventlog_security` EventCode=5136  AttributeSyntaxOID=2.5.5.12 AttributeValue=$displayName$" | rename AttributeValue as displayName] 
-  | stats min(_time) as _time values(displayName) as gp_name, values(gPCFileSysPath) as gPCFileSysPath, values(src_user) as src_user, values(dest) as dest, values(dest_category) as dest_category, values(src_user_category) as src_user_category by displayName 
+  | stats min(_time) as _time values(displayName) as gp_name, values(gPCFileSysPath) as gPCFileSysPath, values(src_user) as src_user, values(dest) as dest, values(dest_category) as dest_category, values(src_user_category) as src_user_category by displayName
   | `windows_admon_group_policy_object_created_filter`'
 how_to_implement: To successfully implement this search, you need to be monitoring Active Directory logs using Admon. Details can be found here
   https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/Data/MonitorActiveDirectory

lookups/msad_guid_lookup.csv

@@ -1580,3 +1580,99 @@ globalAddressList2,"4898f63d-4112-477c-8826-3ca00bd8277d","AD Attribute"
 templateRoots2,"b1cba91a-0682-4362-a659-153e201ef069","AD Attribute"
 "ms-Mcs-AdmPwdExpirationTime","b6b11ea3-6db4-4bae-8a4b-94a54250c869","AD Attribute"
 "ms-Mcs-AdmPwd","71f6c31d-531d-4c45-828e-db6cdab302c8","AD Attribute"
+Applications,"{F9C77450-3A41-477E-9310-9ACD617BD9E3}","CSE GUID"
+"Data Sources","{728EE579-943C-4519-9EF7-AB56765798ED}","CSE GUID"
+Devices,"{1A6364EB-776B-4120-ADE1-B63A406A76B5}","CSE GUID"
+Drives,"{5794DAFD-BE60-433F-88A2-1A31939AC01F}","CSE GUID"
+"Environment Variables","{0E28E245-9368-4853-AD84-6DA3BA35BB75}","CSE GUID"
+Files,"{7150F9BF-48AD-4DA4-A49C-29EF4A8369BA}","CSE GUID"
+"Folder Options","{A3F3E39B-5D83-4940-B954-28315B82F0A8}","CSE GUID"
+Folders,"{6232C319-91AC-4931-9385-E70C2B099F0E}","CSE GUID"
+"Ini Files","{74EE6C03-5363-4554-B161-627540339CAB}","CSE GUID"
+"Internet Settings","{E47248BA-94CC-49C4-BBB5-9EB7F05183D0}","CSE GUID"
+"Local users and groups","{17D89FEC-5C44-4972-B12D-241CAEF74509}","CSE GUID"
+"Network Options","{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}","CSE GUID"
+"Network Shares","{6A4C88C6-C502-4F74-8F60-2CB23EDC24E2}","CSE GUID"
+"Power Options","{E62688F0-25FD-4C90-BFF5-F508B9D2E31F}","CSE GUID"
+Printers,"{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}","CSE GUID"
+"Regional Options","{E5094040-C46C-4115-B030-04FB2E545B00}","CSE GUID"
+Registry,"{B087BE9D-ED37-454F-AF9C-04291E351182}","CSE GUID"
+ScheduledTasks,"{AADCED64-746C-4633-A97C-D61349046527}","CSE GUID"
+Services,"{91FBB303-0CD5-4055-BF42-E512A681B325}","CSE GUID"
+Shortcuts,"{C418DD9D-0D14-4EFB-8FBF-CFE535C8FAC7}","CSE GUID"
+"Start Menu","{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}","CSE GUID"
+Scripts,"{42B5FAAE-6536-11D2-AE5A-0000F87571E3}","CSE GUID"
+Registry,"{35378EAC-683F-11D2-A89A-00C04FBBCFA2}","CSE GUID"
+Applications,"{0DA274B5-EB93-47A7-AAFB-65BA532D3FE6}","Tool extension GUID"
+"Data Sources","{1612B55C-243C-48DD-A449-FFC097B19776}","Tool extension GUID"
+Devices,"{1B767E9A-7BE4-4D35-85C1-2E174A7BA951}","Tool extension GUID"
+Drives,"{2EA1A81B-48E5-45E9-8BB7-A6E3AC170006}","Tool extension GUID"
+"Environment Variables","{35141B6B-498A-4CC7-AD59-CEF93D89B2CE}","Tool extension GUID"
+Files,"{3BAE7E51-E3F4-41D0-853D-9BB9FD47605F}","Tool extension GUID"
+"Folder Options","{3BFAE46A-7F3A-467B-8CEA-6AA34DC71F53}","Tool extension GUID"
+Folders,"{3EC4E9D3-714D-471F-88DC-4DD4471AAB47}","Tool extension GUID"
+"Ini Files","{516FC620-5D34-4B08-8165-6A06B623EDEB}","Tool extension GUID"
+"Internet Settings","{5C935941-A954-4F7C-B507-885941ECE5C4}","Tool extension GUID"
+"Local users and groups","{79F92669-4224-476C-9C5C-6EFB4D87DF4A}","Tool extension GUID"
+"Network Options","{949FB894-E883-42C6-88C1-29169720E8CA}","Tool extension GUID"
+"Network Shares","{BFCBBEB0-9DF4-4C0C-A728-434EA66A0373}","Tool extension GUID"
+"Power Options","{9AD2BAFE-63B4-4883-A08C-C3C6196BCAFD}","Tool extension GUID"
+Printers,"{A8C42CEA-CDB8-4388-97F4-5831F933DA84}","Tool extension GUID"
+"Regional Options","{B9CCA4DE-E2B9-4CBD-BF7D-11B6EBFBDDF7}","Tool extension GUID"
+Registry,"{BEE07A6A-EC9F-4659-B8C9-0B1937907C83}","Tool extension GUID"
+ScheduledTasks,"{CAB54552-DEEA-4691-817E-ED4A4D1AFC72}","Tool extension GUID"
+Services,"{CC5746A9-9B74-4BE5-AE2E-64379C86E0E4}","Tool extension GUID"
+Shortcuts,"{CEFFA6E2-E3BD-421B-852C-6F6A79A59BC1}","Tool extension GUID"
+"Start Menu","{CF848D48-888D-4F45-B530-6A201E62A605}","Tool extension GUID"
+Scripts,"{40B6664F-4972-11D1-A7CA-0000F87571E3}","Tool extension GUID"
+Registry,"{D02B1F72-3407-48AE-BA88-E8213C6761F1}","Tool extension GUID"
+"Computer Policy Settings","{0F6B957D-509E-11D1-A7CC-0000F87571E3}","CSE GUID / Tool extension GUID"
+"User Policy Settings - Restrict Run","{0F6B957E-509E-11D1-A7CC-0000F87571E3}","CSE GUID / Tool extension GUID"
+"Data Sources","{1612B55C-243C-48DD-A449-FFC097B19776}","CSE GUID / Tool extension GUID"
+Devices,"{1B767E9A-7BE4-4D35-85C1-2E174A7BA951}","CSE GUID / Tool extension GUID"
+"Folder Redirection","{25537BA6-77A8-11D2-9B6C-0000F8080861}","CSE GUID / Tool extension GUID"
+"Remote Installation Services","{3060E8CE-7020-11D2-842D-00C04FA372D4}","CSE GUID / Tool extension GUID"
+"Registry Settings","{35378EAC-683F-11D2-A89A-00C04FBBCFA2","CSE GUID / Tool extension GUID"
+"Microsoft Disk Quota","{3610EDA5-77EF-11D2-8DC5-00C04FA31A66}","CSE GUID / Tool extension GUID"
+"Scripts (Logon/Logoff) Run Restriction","{40B66650-4972-11D1-A7CA-0000F87571E3}","CSE GUID / Tool extension GUID"
+ProcessScriptsGroupPolicy,"{42B5FAAE-6536-11D2-AE5A-0000F87571E3}","CSE GUID / Tool extension GUID"
+"Print Policy in PolicyMaker","{47BA4403-1AA0-47F6-BDC5-298F96D1C2E3}","CSE GUID / Tool extension GUID"
+"Internet Explorer Zonemapping","{4CFB60C1-FAA6-47F1-89AA-0B18730C9FD3}","CSE GUID / Tool extension GUID"
+"Certificates Run Restriction","{53D6AB1D-2488-11D1-A28C-00C04FB94F17}","CSE GUID / Tool extension GUID"
+Drives,"{5794DAFD-BE60-433F-88A2-1A31939AC01F}","CSE GUID / Tool extension GUID"
+"Network Shares","{6A4C88C6-C502-4F74-8F60-2CB23EDC24E2}","CSE GUID / Tool extension GUID"
+Files,"{7150F9BF-48AD-4DA4-A49C-29EF4A8369BA}","CSE GUID / Tool extension GUID"
+"Local users and groups","{79F92669-4224-476C-9C5C-6EFB4D87DF4A}","CSE GUID / Tool extension GUID"
+"Internet Explorer User Accelerators/PolicyMaker","{7B849A69-220F-451E-B3FE-2CB811AF94AE}","CSE GUID / Tool extension GUID"
+"Computer Restricted Groups","{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}","CSE GUID / Tool extension GUID"
+Security,"{827D319E-6EAC-11D2-A4EA-00C04F79F83A}","CSE GUID / Tool extension GUID"
+"Folder Redirection","{88E729D6-BDC1-11D1-BD2A-00C04FB9603F}","CSE GUID / Tool extension GUID"
+"Deployed Printer Connections","{8A28E2C5-8D06-49A4-A08C-632DAA493E17}","CSE GUID / Tool extension GUID"
+"Software Installation (Computers).","{942A8E4F-A261-11D1-A760-00C04FB9603F}","CSE GUID / Tool extension GUID"
+"Internet Explorer Maintenance policy processing","{A2E30F80-D7DE-11D2-BBDE-00C04F86AE3B]","CSE GUID / Tool extension GUID"
+Registry,"{B087BE9D-ED37-454F-AF9C-04291E351182}","CSE GUID / Tool extension GUID"
+"EFS Recovery","{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A]","CSE GUID / Tool extension GUID"
+"802.3 Group Policy","{B587E2B1-4D59-4E7E-AED9-22B9DF11D053}","CSE GUID / Tool extension GUID"
+"Software Installation (Users) Run Restriction","{BACF5C8A-A3C7-11D1-A760-00C04FB9603F}","CSE GUID / Tool extension GUID"
+"Network Shares","{BFCBBEB0-9DF4-4C0C-A728-434EA66A0373}","CSE GUID / Tool extension GUID"
+Shortcuts,"{C418DD9D-0D14-4EFB-8FBF-CFE535C8FAC7}","CSE GUID / Tool extension GUID"
+"Microsoft Offline Files","{C631DF4C-088F-4156-B058-4375F0853CD8}","CSE GUID / Tool extension GUID"
+"Application Management","{C6DC5466-785A-11D2-84D0-00C04FB169F7]","CSE GUID / Tool extension GUID"
+Services,"{CC5746A9-9B74-4BE5-AE2E-64379C86E0E4}","CSE GUID / Tool extension GUID"
+"User Policy Settings","{D02B1F73-3407-48AE-BA88-E8213C6761F1}","CSE GUID / Tool extension GUID"
+"Power Options","{E62688F0-25FD-4C90-BFF5-F508B9D2E31F}","CSE GUID / Tool extension GUID"
+"Policy Maker","{F0DB2806-FD46-45B7-81BD-AA3744B32765}","CSE GUID / Tool extension GUID"
+"Policy Maker","{F17E8B5B-78F2-49A6-8933-7B767EDA5B41}","CSE GUID / Tool extension GUID"
+"Policy Maker","{F27A6DA8-D22B-4179-A042-3D715F9E75B5}","CSE GUID / Tool extension GUID"
+"Policy Maker","{F581DAE7-8064-444A-AEB3-1875662A61CE}","CSE GUID / Tool extension GUID"
+"Policy Maker","{F648C781-42C9-4ED4-BB24-AEB8853701D0}","CSE GUID / Tool extension GUID"
+"Policy Maker","{F6E72D5A-6ED3-43D9-9710-4440455F6934}","CSE GUID / Tool extension GUID"
+"Enterprise QoS","{FB2CA36D-0B40-4307-821B-A13B252DE56C}","CSE GUID / Tool extension GUID"
+"Internet Explorer Maintenance Extension protocol","{FC715823-C5FB-11D1-9EEF-00A0C90347FF}","CSE GUID / Tool extension GUID"
+"Policy Maker","{FD2D917B-6519-4BF7-8403-456C0C64312F}","CSE GUID / Tool extension GUID"
+"Policy Maker","{FFC64763-70D2-45BC-8DEE-7ACAF1BA7F89}","CSE GUID / Tool extension GUID"
+TCPIP,"{CDEAFC3D-948D-49DD-AB12-E578BA4AF7AA}","CSE GUID / Tool extension GUID"
+"IP Security","{E437BC1C-AA7D-11D2-A382-00C04F991E27]","CSE GUID / Tool extension GUID"
+"Audit Policy Configuration","{F3CCC681-B74C-4060-9F26-CD84525DCA2A}","CSE GUID / Tool extension GUID"
+"Windows Firewall","{B05566AC-FE9C-4368-BE01-7A4CBB6CBA11}","CSE GUID / Tool extension GUID"
+"Software Installation","{C6DC5466-785A-11D2-84D0-00C04FB169F7}","CSE GUID / Tool extension GUID"