From a26ec4a671bb0f8ecde8bbd67ed4c63a40b64f14 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 30 Sep 2022 17:33:44 -0400 Subject: [PATCH] update dc shadow detection --- ...adow_attack.yml => windows_dcshadow_attack.yml} | 14 ++++++++++---- stories/windows_domain_controller_attacks.yml | 2 +- ...k.test.yml => windows_dcshadow_attack.test.yml} | 6 +++--- 3 files changed, 14 insertions(+), 8 deletions(-) rename detections/endpoint/{dcshadow_attack.yml => windows_dcshadow_attack.yml} (71%) rename tests/endpoint/{dcshadow_attack.test.yml => windows_dcshadow_attack.test.yml} (77%) diff --git a/detections/endpoint/dcshadow_attack.yml b/detections/endpoint/windows_dcshadow_attack.yml similarity index 71% rename from detections/endpoint/dcshadow_attack.yml rename to detections/endpoint/windows_dcshadow_attack.yml index a39ca58913..5f7e737bd3 100644 --- a/detections/endpoint/dcshadow_attack.yml +++ b/detections/endpoint/windows_dcshadow_attack.yml @@ -1,11 +1,14 @@ -name: DCShadow Attack +name: Windows DCShadow Attack id: 57e27f27-369c-4df8-af08-e8c7ee8373d4 -version: 1 +version: 2 date: '2022-09-02' author: Dean Luxton type: TTP datamodel: [] -description: DCshadow is a Post Exploitation attack added to Mimikatz in 2018. The DCShadow attack requires domain admin privileges or equivalent. The attack works by temporarily assuming the role of a domain controller and pushing replication changes to the domain. No event logs are written for changes to AD attributes, allowing for stealthy backdoors to be implanted in the domain, or metadata such as timestamps overwritten to cover tracks. +description: The following analytic identifies a change in an Active Directory environment that could represent evidence of the DCShadow attack. + DCShadow allows an attacker who has obtained privileged access to register a rogue Domain Controller (DC). Once registered, the rogue DC may be able to inject + and replicate changes int the AD infrastructure for any domain object, including credentials and keys. This technique was initially released in 2018 by security researchers Benjamin Delpy and Vincent Le Toux. + No event logs are written for changes to AD attributes, allowing for stealthy backdoors to be implanted in the domain, or metadata such as timestamps overwritten to cover tracks. search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName (AttributeValue="GC/*" OR AttributeValue="E3514235-4B06-11D1-AB04-00C04FC2DCD2/*") | replace "%%14674" with "Value Added", "%%14675" with "Value Deleted" in OperationType | stats min(_time) as firstEvent max(_time) as latestEvent values(OperationType) as Action range(_time) as duration by src_nt_domain, src_user, Computer, ObjectDN, Logon_ID, signature @@ -13,7 +16,7 @@ search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=serviceP | join type=outer Logon_ID [| search `wineventlog_security` EventCode=4624 | rename TargetLogonId as Logon_ID src_ip as src] | table firstEvent, latestEvent, duration, src_nt_domain, src_user, Computer, ObjectDN, Action, signature, src, Logon_ID | eval firstEvent=strftime(firstEvent, "%Y-%m-%d %H:%M:%S"), latestEvent=strftime(latestEvent, "%Y-%m-%d %H:%M:%S") -| `dcshadow_attack_filter`' +| `windows_dcshadow_attack_filter`' how_to_implement: To successfully implement this search, you ned to be ingesting eventcode `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled, alongside a SACL for `everybody` to @@ -21,7 +24,10 @@ how_to_implement: To successfully implement this search, you ned to be ingesting known_false_positives: None. references: - https://www.dcshadow.com/ +- https://blog.netwrix.com/2022/09/28/dcshadow_attack/ - https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2 +- https://attack.mitre.org/techniques/T1207/ +- https://blog.alsid.eu/dcshadow-explained-4510f52fc19d tags: analytic_story: - Windows Domain Controller Attacks diff --git a/stories/windows_domain_controller_attacks.yml b/stories/windows_domain_controller_attacks.yml index 9cf9e2a04b..3b1a2ff073 100644 --- a/stories/windows_domain_controller_attacks.yml +++ b/stories/windows_domain_controller_attacks.yml @@ -4,7 +4,7 @@ version: 1 date: '2022-08-29' author: Dean Luxton, Mauricio Velazco description: Monitor for activities and techniques associated with replication based attacks which target domain controllers and post-exploitation active directory persistence techniques. -narrative: This analytic story provides detections for some of the highest impact attacks which can be performed against an active directory network. +narrative: This analytic story provides detections for some of the highest impact attacks which can be performed against an Active Directory network. Featuring attacks which leverage flaws within replication (MS probably wont fix these any time soon), enabling backdoor accounts and other stealthy persistence techniques. It is imperative to enable the necessary GPOs and SACLs required, otherwise the eventcodes will not trigger. Each detection includes a list of requirements for enabling logging. references: diff --git a/tests/endpoint/dcshadow_attack.test.yml b/tests/endpoint/windows_dcshadow_attack.test.yml similarity index 77% rename from tests/endpoint/dcshadow_attack.test.yml rename to tests/endpoint/windows_dcshadow_attack.test.yml index 77cadc89aa..a463e80413 100644 --- a/tests/endpoint/dcshadow_attack.test.yml +++ b/tests/endpoint/windows_dcshadow_attack.test.yml @@ -1,7 +1,7 @@ -name: DCShadow Attack Unit Test +name: Windows DCShadow Attack Unit Test tests: -- name: DCShadow Attack - file: endpoint/dcshadow_attack.yml +- name: Windows DCShadow Attack + file: endpoint/windows_dcshadow_attack.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now