From dee4f1b672e419d2f1bbcffa85bd8351320f8f2e Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Wed, 21 Sep 2022 09:09:34 +1000 Subject: [PATCH] Updating Analytic Story --- stories/windows_domain_controller_attacks.yml | 2 +- ...e_directory_sid_history_privileged_account_addition.test.yml | 0 .../{ => network}/rogue_dc_network_activity.test.yml | 0 3 files changed, 1 insertion(+), 1 deletion(-) rename tests/experimental/{ => endpoint}/active_directory_sid_history_privileged_account_addition.test.yml (100%) rename tests/experimental/{ => network}/rogue_dc_network_activity.test.yml (100%) diff --git a/stories/windows_domain_controller_attacks.yml b/stories/windows_domain_controller_attacks.yml index 9f58a6379a..14f21fe1c5 100644 --- a/stories/windows_domain_controller_attacks.yml +++ b/stories/windows_domain_controller_attacks.yml @@ -5,7 +5,7 @@ date: '2022-08-29' author: Dean Luxton, Mauricio Velazco description: Monitor for activities and techniques associated with replication based attacks which target domain controllers and post-exploitation active directory persistence techniques. narrative: This analytic story provides detections for some of the highest impact attacks which can be performed against an active directory network. - Featuring attacks which leverage flaws within replication (read MS probably won’t fix these any time soon), enabling backdoor accounts and other stealthy persistence techniques. + Featuring attacks which leverage flaws within replication [MS probably won’t fix these any time soon], enabling backdoor accounts and other stealthy persistence techniques. It is imperative to enable the necessary GPOs and SACLs required - otherwise the eventcodes will not trigger. Each detection includes a list of requirements for enabling logging. references: - https://adsecurity.org/?p=1929 diff --git a/tests/experimental/active_directory_sid_history_privileged_account_addition.test.yml b/tests/experimental/endpoint/active_directory_sid_history_privileged_account_addition.test.yml similarity index 100% rename from tests/experimental/active_directory_sid_history_privileged_account_addition.test.yml rename to tests/experimental/endpoint/active_directory_sid_history_privileged_account_addition.test.yml diff --git a/tests/experimental/rogue_dc_network_activity.test.yml b/tests/experimental/network/rogue_dc_network_activity.test.yml similarity index 100% rename from tests/experimental/rogue_dc_network_activity.test.yml rename to tests/experimental/network/rogue_dc_network_activity.test.yml