admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inDomain Group Discovery with Adsisearcher

Browse Source
This commit is contained in:
root
2021-09-10 00:34:04 +00:00
parent 643d520bcf
commit 93c7166e8c
1 changed files with 10 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/domain_group_discovery_with_adsisearcher.yml
+10 -7
View File
@@ -7,18 +7,20 @@ type: TTP
datamodel:
- Endpoint
description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups.
Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain groups for situational awareness and Active Directory Discovery.
search: '`powershell` EventCode=4104 (Message = "*[adsisearcher]*" AND Message = "*(objectcategory=group)*" AND Message = "*findAll()*")
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
ComputerName User | `security_content_ctime(firstTime)` | `domain_group_discovery_with_adsisearcher_filter`'
to identify the `[Adsisearcher]` type accelerator being used to query Active Directory
for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate
domain groups for situational awareness and Active Directory Discovery.
search: '`powershell` EventCode=4104 (Message = "*[adsisearcher]*" AND Message = "*(objectcategory=group)*"
AND Message = "*findAll()*") | stats count min(_time) as firstTime max(_time) as
lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
| `domain_group_discovery_with_adsisearcher_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: Administrators or power users may use Adsisearcher for troubleshooting.
references:
- https://attack.mitre.org/techniques/T1069/002/
- https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/
- https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/
tags:
analytic_story:
- Active Directory Discovery
@@ -47,4 +49,5 @@ tags:
- name: dest
type: Endpoint
role:
- Victim
- Victim
automated_detection_testing: passed