From a46c2117bb019f55ca62a5400252175e3e42e1cd Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 8 Feb 2023 17:04:38 -0500 Subject: [PATCH] renaming analytic story --- detections/endpoint/windows_ad_adminsdholder_acl_modified.yml | 2 +- .../endpoint/windows_ad_cross_domain_sid_history_addition.yml | 2 +- .../windows_ad_domain_controller_audit_policy_disabled.yml | 2 +- .../endpoint/windows_ad_domain_controller_promotion.yml | 2 +- .../endpoint/windows_ad_domain_replication_acl_addition.yml | 2 +- detections/endpoint/windows_ad_dsrm_account_changes.yml | 2 +- detections/endpoint/windows_ad_dsrm_password_reset.yml | 2 +- ...ndows_ad_replication_request_initiated_by_user_account.yml | 2 +- ...plication_request_initiated_from_unsanctioned_location.yml | 2 +- .../endpoint/windows_ad_same_domain_sid_history_addition.yml | 2 +- ...ows_ad_short_lived_domain_account_serviceprincipalname.yml | 2 +- ...windows_ad_short_lived_domain_controller_spn_attribute.yml | 2 +- detections/endpoint/windows_ad_short_lived_server_object.yml | 2 +- .../endpoint/windows_ad_sid_history_attribute_modified.yml | 2 +- ...tive_directory_privileged_account_sid_history_addition.yml | 2 +- detections/experimental/network/rogue_dc_network_activity.yml | 2 +- .../network/windows_ad_replication_service_traffic.yml | 2 +- ...cks.yml => sneaky_active_directory_persistence_tricks.yml} | 4 ++-- 18 files changed, 19 insertions(+), 19 deletions(-) rename stories/{windows_domain_controller_attacks.yml => sneaky_active_directory_persistence_tricks.yml} (93%) diff --git a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml index ace270bb4e..9218bbdecd 100644 --- a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml +++ b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml @@ -29,7 +29,7 @@ references: - https://medium.com/@cryps1s/detecting-windows-endpoint-compromise-with-sacls-cd748e10950 tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml b/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml index 810301dded..e88f948647 100644 --- a/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml +++ b/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml @@ -26,7 +26,7 @@ references: - https://learn.microsoft.com/en-us/defender-for-identity/security-assessment-unsecure-sid-history-attribute tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint cis20: - CIS 4 diff --git a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml index 7804e7f6d9..8e5807a6f7 100644 --- a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml +++ b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml @@ -27,7 +27,7 @@ references: - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4719 tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint cis20: - CIS 4 diff --git a/detections/endpoint/windows_ad_domain_controller_promotion.yml b/detections/endpoint/windows_ad_domain_controller_promotion.yml index a0492d4d5c..dda3b1e0c4 100644 --- a/detections/endpoint/windows_ad_domain_controller_promotion.yml +++ b/detections/endpoint/windows_ad_domain_controller_promotion.yml @@ -29,7 +29,7 @@ references: - https://attack.mitre.org/techniques/T1207/ tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint cis20: - CIS 4 diff --git a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml index 6a7e961cc4..ff73722cfc 100644 --- a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml +++ b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml @@ -43,7 +43,7 @@ references: - https://github.com/SigmaHQ/sigma/blob/29a5c62784faf986dc03952ae3e90e3df3294284/rules/windows/builtin/security/win_security_account_backdoor_dcsync_rights.yml tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint cis20: - CIS 6 diff --git a/detections/endpoint/windows_ad_dsrm_account_changes.yml b/detections/endpoint/windows_ad_dsrm_account_changes.yml index 629776bbfc..934fe94634 100644 --- a/detections/endpoint/windows_ad_dsrm_account_changes.yml +++ b/detections/endpoint/windows_ad_dsrm_account_changes.yml @@ -32,7 +32,7 @@ references: - https://adsecurity.org/?p=1714 tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks - Windows Registry Abuse - Windows Persistence Techniques asset_type: Endpoint diff --git a/detections/endpoint/windows_ad_dsrm_password_reset.yml b/detections/endpoint/windows_ad_dsrm_password_reset.yml index 6dd8b5ade5..3664351cc2 100644 --- a/detections/endpoint/windows_ad_dsrm_password_reset.yml +++ b/detections/endpoint/windows_ad_dsrm_password_reset.yml @@ -22,7 +22,7 @@ references: - https://adsecurity.org/?p=1714 tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint cis20: - CIS 6 diff --git a/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml b/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml index 597b637a2d..928ba49bab 100644 --- a/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml +++ b/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml @@ -29,7 +29,7 @@ references: - https://github.com/SigmaHQ/sigma/blob/0.22-699-g29a5c6278/rules/windows/builtin/security/win_security_dcsync.yml tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks - Credential Dumping asset_type: Endpoint cis20: diff --git a/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml b/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml index 38c68957e2..54787ae31f 100644 --- a/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml +++ b/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml @@ -46,7 +46,7 @@ references: - https://github.com/SigmaHQ/sigma/blob/0.22-699-g29a5c6278/rules/windows/builtin/security/win_security_dcsync.yml tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks - Credential Dumping asset_type: Endpoint cis20: diff --git a/detections/endpoint/windows_ad_same_domain_sid_history_addition.yml b/detections/endpoint/windows_ad_same_domain_sid_history_addition.yml index 047699ee87..8f2ed5bf6a 100644 --- a/detections/endpoint/windows_ad_same_domain_sid_history_addition.yml +++ b/detections/endpoint/windows_ad_same_domain_sid_history_addition.yml @@ -29,7 +29,7 @@ references: - https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/sid-history-injection tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks - Windows Persistence Techniques asset_type: Endpoint cis20: diff --git a/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml b/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml index c36106f2fc..c2547ed833 100644 --- a/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml +++ b/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml @@ -26,7 +26,7 @@ references: - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/windows_ad_short_lived_domain_controller_spn_attribute.yml b/detections/endpoint/windows_ad_short_lived_domain_controller_spn_attribute.yml index 373f6a70ee..e833fc8f8c 100644 --- a/detections/endpoint/windows_ad_short_lived_domain_controller_spn_attribute.yml +++ b/detections/endpoint/windows_ad_short_lived_domain_controller_spn_attribute.yml @@ -31,7 +31,7 @@ references: - https://blog.alsid.eu/dcshadow-explained-4510f52fc19d tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint cis20: - CIS 4 diff --git a/detections/endpoint/windows_ad_short_lived_server_object.yml b/detections/endpoint/windows_ad_short_lived_server_object.yml index 72e98b1d0a..ed5b2cf8c9 100644 --- a/detections/endpoint/windows_ad_short_lived_server_object.yml +++ b/detections/endpoint/windows_ad_short_lived_server_object.yml @@ -30,7 +30,7 @@ references: - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5141 tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/windows_ad_sid_history_attribute_modified.yml b/detections/endpoint/windows_ad_sid_history_attribute_modified.yml index 3b828b08e8..d87b775222 100644 --- a/detections/endpoint/windows_ad_sid_history_attribute_modified.yml +++ b/detections/endpoint/windows_ad_sid_history_attribute_modified.yml @@ -22,7 +22,7 @@ references: - https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/sid-history-injection tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/experimental/endpoint/windows_active_directory_privileged_account_sid_history_addition.yml b/detections/experimental/endpoint/windows_active_directory_privileged_account_sid_history_addition.yml index a1e63ec3f2..45fe77440e 100644 --- a/detections/experimental/endpoint/windows_active_directory_privileged_account_sid_history_addition.yml +++ b/detections/experimental/endpoint/windows_active_directory_privileged_account_sid_history_addition.yml @@ -28,7 +28,7 @@ references: - https://adsecurity.org/?p=1772 tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint cis20: - CIS 4 diff --git a/detections/experimental/network/rogue_dc_network_activity.yml b/detections/experimental/network/rogue_dc_network_activity.yml index 9687b49ff4..960cd7222e 100644 --- a/detections/experimental/network/rogue_dc_network_activity.yml +++ b/detections/experimental/network/rogue_dc_network_activity.yml @@ -17,7 +17,7 @@ references: - https://adsecurity.org/?p=1729 tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint cis20: - CIS 4 diff --git a/detections/experimental/network/windows_ad_replication_service_traffic.yml b/detections/experimental/network/windows_ad_replication_service_traffic.yml index ef95d459b8..3d862b148d 100644 --- a/detections/experimental/network/windows_ad_replication_service_traffic.yml +++ b/detections/experimental/network/windows_ad_replication_service_traffic.yml @@ -28,7 +28,7 @@ references: - https://attack.mitre.org/techniques/T1207/ tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks asset_type: endpoint cis20: - CIS 3 diff --git a/stories/windows_domain_controller_attacks.yml b/stories/sneaky_active_directory_persistence_tricks.yml similarity index 93% rename from stories/windows_domain_controller_attacks.yml rename to stories/sneaky_active_directory_persistence_tricks.yml index 3b1a2ff073..bdeacbb607 100644 --- a/stories/windows_domain_controller_attacks.yml +++ b/stories/sneaky_active_directory_persistence_tricks.yml @@ -1,8 +1,8 @@ -name: Windows Domain Controller Attacks +name: Sneaky Active Directory Persistence Tricks id: f676c4c1-c769-4ecb-9611-5fd85b497c56 version: 1 date: '2022-08-29' -author: Dean Luxton, Mauricio Velazco +author: Dean Luxton, Mauricio Velazco, Splunk description: Monitor for activities and techniques associated with replication based attacks which target domain controllers and post-exploitation active directory persistence techniques. narrative: This analytic story provides detections for some of the highest impact attacks which can be performed against an Active Directory network. Featuring attacks which leverage flaws within replication (MS probably wont fix these any time soon), enabling backdoor accounts and other stealthy persistence techniques.