Adding Privileged User SID History Detection

bin/docker_detection_tester/ansible/roles/update_escu/files/props.conf

@@ -1,2 +0,0 @@
-[XmlWinEventLog]
-BREAK_ONLY_BEFORE=<Event\sxmlns

bin/docker_detection_tester/ansible/roles/update_escu/tasks/main.yml

@@ -14,18 +14,6 @@
     group: splunk
   become: yes
 
-- name: make /opt writetable by splunk
-  become: true
-  file: path=/opt/splunk/etc/system/local mode=777
-
-- name: copy props.conf to fix XMLWinEventlog parsing issue
-  become: true
-  command: "echo '[XmlWinEventLog]' >  /opt/splunk/etc/system/local/props.conf"
-
-- name: copy props.conf to fix XMLWinEventlog parsing issue
-  become: true
-  command: "echo 'BREAK_ONLY_BEFORE=<Event\sxmlns' >>  /opt/splunk/etc/system/local/props.conf"
-
 - name: restart containerized splunk
   ansible.builtin.shell: echo "[XmlWinEventLog]" >  /opt/splunk/etc/system/local/props.conf && echo "BREAK_ONLY_BEFORE=<Event\sxmlns" >> /opt/splunk/etc/system/local/props.conf && /opt/splunk/bin/splunk restart
   become: yes

detections/endpoint/active_directory_sid_history_privileged_account_addition.yml

@@ -0,0 +1,77 @@
+name: Active Directory SID History Privileged Account Addition
+id: 6b521149-b91c-43aa-ba97-c2cac59ec830
+version: 1
+date: '2022-09-12'
+author: Dean Luxton
+type: TTP
+datamodel: []
+description: This detection identifies when the SID of a privileged user is added to
+ the SID History attribute of another user. Useful for tracking SID history abuse 
+ accross multiple domains. This detection leverages the Asset and Identities 
+ framework. See the how to implement section for further details on configuration.  
+search: "`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistory\
+  \ IN (\"%%1793\", -) \n| rex field=SidHistory \"(^%{|^)(?P<SidHistory>.*?)(}$|$)\"\
+  \ \n| eval category=\"privileged\" \n| lookup identity_lookup_expanded category,\
+  \ identity as SidHistory OUTPUT identity_tag as match \n| where isnotnull(match)\n\
+  | rename TargetSid as userSid \n| table _time action status host user userSid SidHistory\
+  \ Logon_ID src_user | `active_directory_sid_history_privileged_account_addition_filter`"
+how_to_implement: Ensure you have objectSid & the Down-Level Logon Name (`DOMAIN\sAMACountName`)
+ added to the identity field of your Asset & Identities lookup, along with the 
+ category of privileged for the applicable users. If unsure, a great starting point 
+ is all users with the AdminCount attribute set with the value of 1. 
+ Also ensure you are ingesting eventcodes 4742 and 4738.
+ Two advanced audit policies `Audit User Account Management` 
+ and  `Audit Computer Account Management` under 
+ `Account Management` are required to generate these event codes. 
+known_false_positives: Migration of privileged accounts. 
+references:
+- https://adsecurity.org/?p=1772
+tags:
+  analytic_story:
+  - Domain Controller Attacks
+  asset_type: Endpoint
+  cis20:
+  - CIS 4
+  - CIS 6
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Source:AD
+  - Stage:Defense Evasion
+  - Stage:Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134.005/mimikatz/windows-security-xml.log
+  impact: 100
+  kill_chain_phases:
+  - Actions on Objectives
+  message: A Privileged User Account SID History Attribute was added to $user$ by $src_user$
+  mitre_attack_id:
+  - T1134.005
+  - T1134
+  nist:
+  - DE.CM
+  observable:
+  - name: src_user
+    type: User
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - SidHistory
+  - TargetSid
+  - TargetDomainName
+  - user
+  - src_user
+  - Logon_ID
+  risk_score: 90
+  security_domain: endpoint

detections/experimental/endpoint/active_directory_sid_history_privileged_account_addition.yml

@@ -19,7 +19,6 @@ how_to_implement: Ensure you have objectSid & the Down-Level Logon Name (`DOMAIN
  added to the identity field of your Asset & Identities lookup, along with the 
  category of privileged for the applicable users. If unsure, a great starting point 
  is all users with the AdminCount attribute set with the value of 1. 
- 
  Also ensure you are ingesting eventcodes 4742 and 4738.
  Two advanced audit policies `Audit User Account Management` 
  and  `Audit Computer Account Management` under