update dc shadow detection

detections/endpoint/windows_dcshadow_attack.yml

@@ -1,11 +1,14 @@
-name: DCShadow Attack
+name: Windows DCShadow Attack
 id: 57e27f27-369c-4df8-af08-e8c7ee8373d4 
-version: 1
+version: 2
 date: '2022-09-02'
 author: Dean Luxton
 type: TTP
 datamodel: []
-description: DCshadow is a Post Exploitation attack added to Mimikatz in 2018. The DCShadow attack requires domain admin privileges or equivalent. The attack works by temporarily assuming the role of a domain controller and pushing replication changes to the domain. No event logs are written for changes to AD attributes, allowing for stealthy backdoors to be implanted in the domain, or metadata such as timestamps overwritten to cover tracks. 
+description: The following analytic identifies a change in an Active Directory environment that could represent evidence of the DCShadow attack.  
+  DCShadow allows an attacker who has obtained privileged access to register a rogue Domain Controller (DC). Once registered, the rogue DC may be able to inject
+  and replicate changes int the AD infrastructure for any domain object, including credentials and keys. This technique was initially released in 2018 by security researchers Benjamin Delpy and Vincent Le Toux.
+  No event logs are written for changes to AD attributes, allowing for stealthy backdoors to be implanted in the domain, or metadata such as timestamps overwritten to cover tracks. 
 search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName (AttributeValue="GC/*" OR AttributeValue="E3514235-4B06-11D1-AB04-00C04FC2DCD2/*")
 | replace "%%14674" with "Value Added", "%%14675" with "Value Deleted" in OperationType
 | stats min(_time) as firstEvent max(_time) as latestEvent values(OperationType) as Action range(_time) as duration by src_nt_domain, src_user, Computer, ObjectDN, Logon_ID, signature
@@ -13,7 +16,7 @@ search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=serviceP
 | join type=outer Logon_ID [| search `wineventlog_security` EventCode=4624  | rename TargetLogonId as Logon_ID src_ip as src]
 | table firstEvent, latestEvent, duration, src_nt_domain, src_user, Computer, ObjectDN, Action, signature, src, Logon_ID
 | eval firstEvent=strftime(firstEvent, "%Y-%m-%d %H:%M:%S"), latestEvent=strftime(latestEvent, "%Y-%m-%d %H:%M:%S")
-| `dcshadow_attack_filter`' 
+| `windows_dcshadow_attack_filter`' 
 how_to_implement: To successfully implement this search, you ned to be ingesting eventcode 
  `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` 
  within `DS Access` needs to be enabled, alongside a SACL for `everybody` to 
@@ -21,7 +24,10 @@ how_to_implement: To successfully implement this search, you ned to be ingesting
 known_false_positives: None.
 references:
 - https://www.dcshadow.com/
+- https://blog.netwrix.com/2022/09/28/dcshadow_attack/
 - https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2
+- https://attack.mitre.org/techniques/T1207/
+- https://blog.alsid.eu/dcshadow-explained-4510f52fc19d 
 tags:
   analytic_story:
   - Windows Domain Controller Attacks

stories/windows_domain_controller_attacks.yml

@@ -4,7 +4,7 @@ version: 1
 date: '2022-08-29'
 author: Dean Luxton, Mauricio Velazco
 description: Monitor for activities and techniques associated with replication based attacks which target domain controllers and post-exploitation active directory persistence techniques. 
-narrative: This analytic story provides detections for some of the highest impact attacks which can be performed against an active directory network. 
+narrative: This analytic story provides detections for some of the highest impact attacks which can be performed against an Active Directory network. 
   Featuring attacks which leverage flaws within replication (MS probably wont fix these any time soon), enabling backdoor accounts and other stealthy persistence techniques. 
   It is imperative to enable the necessary GPOs and SACLs required, otherwise the eventcodes will not trigger. Each detection includes a list of requirements for enabling logging.  
 references: 

tests/endpoint/windows_dcshadow_attack.test.yml

@@ -1,7 +1,7 @@
-name: DCShadow Attack Unit Test
+name: Windows DCShadow Attack Unit Test
 tests:
-- name: DCShadow Attack
-  file: endpoint/dcshadow_attack.yml
+- name: Windows DCShadow Attack
+  file: endpoint/windows_dcshadow_attack.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: -24h
   latest_time: now