From cb381af6bae7fa56a5fdc9d7caa445ee3012dcfe Mon Sep 17 00:00:00 2001 From: root Date: Fri, 10 Sep 2021 16:00:25 +0000 Subject: [PATCH] Added detection testing service results inElevated Group Discovery with PowerView --- ...levated_group_discovery_with_powerview.yml | 23 +++++++++++-------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/elevated_group_discovery_with_powerview.yml b/detections/endpoint/elevated_group_discovery_with_powerview.yml index 4ae7bdc49b..768c73b799 100644 --- a/detections/endpoint/elevated_group_discovery_with_powerview.yml +++ b/detections/endpoint/elevated_group_discovery_with_powerview.yml @@ -7,13 +7,17 @@ type: Hunting datamodel: - Endpoint description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - to identify the execution of the `Get-DomainGroupMember` commandlet. `Get-DomainGroupMember` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. - As the name suggests, `Get-DomainGroupMember` is used to list the members of an specific domain group. - Red Teams and adversaries alike use PowerView to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. -search: '`powershell` EventCode=4104 (Message = "*Get-DomainGroupMember*") - AND Message IN ("*Domain Admins*","*Enterprise Admins*", "*Schema Admins*", "*Account Operators*" , "*Server Operators*", "*Protected Users*", "*Dns Admins*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message - ComputerName User | `security_content_ctime(firstTime)` | `elevated_group_discovery_with_powerview_filter`' + to identify the execution of the `Get-DomainGroupMember` commandlet. `Get-DomainGroupMember` + is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. + As the name suggests, `Get-DomainGroupMember` is used to list the members of an + specific domain group. Red Teams and adversaries alike use PowerView to enumerate + elevated domain groups for situational awareness and Active Directory Discovery + to identify high privileged users. +search: '`powershell` EventCode=4104 (Message = "*Get-DomainGroupMember*") AND Message + IN ("*Domain Admins*","*Enterprise Admins*", "*Schema Admins*", "*Account Operators*" + , "*Server Operators*", "*Protected Users*", "*Dns Admins*") | stats count min(_time) + as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `elevated_group_discovery_with_powerview_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -22,7 +26,7 @@ references: - https://attack.mitre.org/techniques/T1069/002/ - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroupMember/ - https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory -- https://attack.mitre.org/techniques/T1069/002/ +- https://attack.mitre.org/techniques/T1069/002/ tags: analytic_story: - Active Directory Discovery @@ -51,4 +55,5 @@ tags: - name: dest type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed