From a20f6b726b8b24234903487a7a6a527d1505af06 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 6 Oct 2023 15:46:36 -0400 Subject: [PATCH 1/6] adding new detection - diamond ticket --- ...s_domain_admin_impersonation_indicator.yml | 53 +++++++++++++++++++ lookups/domain_admins.csv | 2 + lookups/domain_admins.yml | 4 ++ 3 files changed, 59 insertions(+) create mode 100644 detections/endpoint/windows_domain_admin_impersonation_indicator.yml create mode 100644 lookups/domain_admins.csv create mode 100644 lookups/domain_admins.yml diff --git a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml new file mode 100644 index 0000000000..abf846d2fa --- /dev/null +++ b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml @@ -0,0 +1,53 @@ +name: Windows Domain Admin Impersonation Indicator +id: 10381f93-6d38-470a-9c30-d25478e3bd3f +version: 1 +date: '2023-10-06' +author: Mauricio Velazco, Splunk +status: production +type: TTP +data_source: [] +description: The following analytic identifies potential Kerberos ticket forging attacks, specifically the Diamond Ticket attack. This is detected when a user logs into a host and the GroupMembership field in event 4627 indicates a privileged group (e.g., Domain Admins), but the user does not actually belong to that group in the directory service. The detection leverages Windows Security Event Log 4627, which logs account logon events. The analytic cross-references the GroupMembership field from the event against a pre-populated lookup of actual group memberships. Itss crucial to note that the accuracy and effectiveness of this detection heavily rely on the users diligence in populating and regularly updating this lookup table. Any discrepancies between the events GroupMembership and the lookup indicate potential ticket forging. Kerberos ticket forging, especially the Diamond Ticket attack, allows attackers to impersonate any user and potentially gain unauthorized access to resources. By forging a ticket that indicates membership in a privileged group, an attacker can bypass security controls and gain elevated privileges. Detecting such discrepancies in group memberships during logon events can be a strong indicator of this attack in progress, making it crucial for security teams to monitor and investigate. If validated as a true positive, this indicates that an attacker has successfully forged a Kerberos ticket and may have gained unauthorized access to critical resources, potentially with elevated privileges. +search: ' `wineventlog_security` EventCode=4627 Logon_Type=3 NOT TargetUserName IN ("*$", "SYSTEM", "DWM-*","LOCAL SERVICE","NETWORK SERVICE", "ANONYMOUS LOGON", "UMFD-*") + | where match(GroupMembership, "Domain Admins") + | lookup domain_admins username as TargetUserName OUTPUT username | fillnull value=NotDA + | search username = "NotDA" + | stats count by _time, TargetUserName, GroupMembership, host + | `windows_domain_admin_impersonation_indicator_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- https://trustedsec.com/blog/a-diamond-in-the-ruff +- https://unit42.paloaltonetworks.com/next-gen-kerberos-attacks +- https://github.com/GhostPack/Rubeus/pull/136 +tags: + analytic_story: + - Active Directory Kerberos Attacks + asset_type: Endpoint + confidence: 100 + impact: 80 + message: $TargetUserName$ may be impersonating a Domain Administrator through a forged Kerberos ticket. + mitre_attack_id: + - T1558 + observable: + - name: TargetUserName + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 80 + required_fields: + - _time, + - EventCode + - Logon_Type + - TargetUserName + - GroupMembership + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558/diamond_ticket/security.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/lookups/domain_admins.csv b/lookups/domain_admins.csv new file mode 100644 index 0000000000..2f9ee7111c --- /dev/null +++ b/lookups/domain_admins.csv @@ -0,0 +1,2 @@ +username +Administrator \ No newline at end of file diff --git a/lookups/domain_admins.yml b/lookups/domain_admins.yml new file mode 100644 index 0000000000..8d7f834d7e --- /dev/null +++ b/lookups/domain_admins.yml @@ -0,0 +1,4 @@ +description: List of domain admins +filename: domain_admins.csv +name: domain_admins +case_sensitive_match: 'false' \ No newline at end of file From f6786d9dcd4da65447617d1beb3f3d64c14361b4 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 9 Oct 2023 11:45:21 -0400 Subject: [PATCH 2/6] fixing detection --- .../endpoint/windows_domain_admin_impersonation_indicator.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml index abf846d2fa..fed9c00272 100644 --- a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml +++ b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml @@ -7,7 +7,7 @@ status: production type: TTP data_source: [] description: The following analytic identifies potential Kerberos ticket forging attacks, specifically the Diamond Ticket attack. This is detected when a user logs into a host and the GroupMembership field in event 4627 indicates a privileged group (e.g., Domain Admins), but the user does not actually belong to that group in the directory service. The detection leverages Windows Security Event Log 4627, which logs account logon events. The analytic cross-references the GroupMembership field from the event against a pre-populated lookup of actual group memberships. Itss crucial to note that the accuracy and effectiveness of this detection heavily rely on the users diligence in populating and regularly updating this lookup table. Any discrepancies between the events GroupMembership and the lookup indicate potential ticket forging. Kerberos ticket forging, especially the Diamond Ticket attack, allows attackers to impersonate any user and potentially gain unauthorized access to resources. By forging a ticket that indicates membership in a privileged group, an attacker can bypass security controls and gain elevated privileges. Detecting such discrepancies in group memberships during logon events can be a strong indicator of this attack in progress, making it crucial for security teams to monitor and investigate. If validated as a true positive, this indicates that an attacker has successfully forged a Kerberos ticket and may have gained unauthorized access to critical resources, potentially with elevated privileges. -search: ' `wineventlog_security` EventCode=4627 Logon_Type=3 NOT TargetUserName IN ("*$", "SYSTEM", "DWM-*","LOCAL SERVICE","NETWORK SERVICE", "ANONYMOUS LOGON", "UMFD-*") +search: ' `wineventlog_security` EventCode=4627 LogonType=3 NOT TargetUserName IN ("*$", "SYSTEM", "DWM-*","LOCAL SERVICE","NETWORK SERVICE", "ANONYMOUS LOGON", "UMFD-*") | where match(GroupMembership, "Domain Admins") | lookup domain_admins username as TargetUserName OUTPUT username | fillnull value=NotDA | search username = "NotDA" From 92b6c09fc558b2fbaf720e700ad16c1b72098c65 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 9 Oct 2023 13:52:36 -0400 Subject: [PATCH 3/6] updating detection --- .../windows_domain_admin_impersonation_indicator.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml index fed9c00272..5a0323ce3e 100644 --- a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml +++ b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml @@ -6,19 +6,20 @@ author: Mauricio Velazco, Splunk status: production type: TTP data_source: [] -description: The following analytic identifies potential Kerberos ticket forging attacks, specifically the Diamond Ticket attack. This is detected when a user logs into a host and the GroupMembership field in event 4627 indicates a privileged group (e.g., Domain Admins), but the user does not actually belong to that group in the directory service. The detection leverages Windows Security Event Log 4627, which logs account logon events. The analytic cross-references the GroupMembership field from the event against a pre-populated lookup of actual group memberships. Itss crucial to note that the accuracy and effectiveness of this detection heavily rely on the users diligence in populating and regularly updating this lookup table. Any discrepancies between the events GroupMembership and the lookup indicate potential ticket forging. Kerberos ticket forging, especially the Diamond Ticket attack, allows attackers to impersonate any user and potentially gain unauthorized access to resources. By forging a ticket that indicates membership in a privileged group, an attacker can bypass security controls and gain elevated privileges. Detecting such discrepancies in group memberships during logon events can be a strong indicator of this attack in progress, making it crucial for security teams to monitor and investigate. If validated as a true positive, this indicates that an attacker has successfully forged a Kerberos ticket and may have gained unauthorized access to critical resources, potentially with elevated privileges. +description: The following analytic identifies potential Kerberos ticket forging attacks, specifically the Diamond Ticket attack. This is detected when a user logs into a host and the GroupMembership field in event 4627 indicates a privileged group (e.g., Domain Admins), but the user does not actually belong to that group in the directory service. The detection leverages Windows Security Event Log 4627, which logs account logon events. The analytic cross-references the GroupMembership field from the event against a pre-populated lookup of actual group memberships. Its crucial to note that the accuracy and effectiveness of this detection heavily rely on the users diligence in populating and regularly updating this lookup table. Any discrepancies between the events GroupMembership and the lookup indicate potential ticket forging. Kerberos ticket forging, especially the Diamond Ticket attack, allows attackers to impersonate any user and potentially gain unauthorized access to resources. By forging a ticket that indicates membership in a privileged group, an attacker can bypass security controls and gain elevated privileges. Detecting such discrepancies in group memberships during logon events can be a strong indicator of this attack in progress, making it crucial for security teams to monitor and investigate. If validated as a true positive, this indicates that an attacker has successfully forged a Kerberos ticket and may have gained unauthorized access to critical resources, potentially with elevated privileges. search: ' `wineventlog_security` EventCode=4627 LogonType=3 NOT TargetUserName IN ("*$", "SYSTEM", "DWM-*","LOCAL SERVICE","NETWORK SERVICE", "ANONYMOUS LOGON", "UMFD-*") | where match(GroupMembership, "Domain Admins") | lookup domain_admins username as TargetUserName OUTPUT username | fillnull value=NotDA | search username = "NotDA" | stats count by _time, TargetUserName, GroupMembership, host | `windows_domain_admin_impersonation_indicator_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +how_to_implement: To successfully implement this search, you need to be ingesting Authentication events across all endpoints and ingest Event Id 4627. Specifically, the Audit Group Membership subcategory within the Logon Logooff category needs to be enabled. Its crucial to note that the accuracy and effectiveness of this detection heavily rely on the users diligence in populating and regularly updating this lookup table. +known_false_positives: False positives may trigger the detections certain scenarios like directory service delays or out of date lookups. Filter as needed. references: - https://trustedsec.com/blog/a-diamond-in-the-ruff - https://unit42.paloaltonetworks.com/next-gen-kerberos-attacks - https://github.com/GhostPack/Rubeus/pull/136 +- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4627 tags: analytic_story: - Active Directory Kerberos Attacks @@ -41,7 +42,7 @@ tags: required_fields: - _time, - EventCode - - Logon_Type + - LogonType - TargetUserName - GroupMembership security_domain: endpoint From 02859139c6db6b742e5cfe805f512d241d8be3e2 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 9 Oct 2023 14:21:01 -0400 Subject: [PATCH 4/6] update detection --- .../endpoint/windows_domain_admin_impersonation_indicator.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml index 5a0323ce3e..a7200981b8 100644 --- a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml +++ b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml @@ -9,7 +9,7 @@ data_source: [] description: The following analytic identifies potential Kerberos ticket forging attacks, specifically the Diamond Ticket attack. This is detected when a user logs into a host and the GroupMembership field in event 4627 indicates a privileged group (e.g., Domain Admins), but the user does not actually belong to that group in the directory service. The detection leverages Windows Security Event Log 4627, which logs account logon events. The analytic cross-references the GroupMembership field from the event against a pre-populated lookup of actual group memberships. Its crucial to note that the accuracy and effectiveness of this detection heavily rely on the users diligence in populating and regularly updating this lookup table. Any discrepancies between the events GroupMembership and the lookup indicate potential ticket forging. Kerberos ticket forging, especially the Diamond Ticket attack, allows attackers to impersonate any user and potentially gain unauthorized access to resources. By forging a ticket that indicates membership in a privileged group, an attacker can bypass security controls and gain elevated privileges. Detecting such discrepancies in group memberships during logon events can be a strong indicator of this attack in progress, making it crucial for security teams to monitor and investigate. If validated as a true positive, this indicates that an attacker has successfully forged a Kerberos ticket and may have gained unauthorized access to critical resources, potentially with elevated privileges. search: ' `wineventlog_security` EventCode=4627 LogonType=3 NOT TargetUserName IN ("*$", "SYSTEM", "DWM-*","LOCAL SERVICE","NETWORK SERVICE", "ANONYMOUS LOGON", "UMFD-*") | where match(GroupMembership, "Domain Admins") - | lookup domain_admins username as TargetUserName OUTPUT username | fillnull value=NotDA + | lookup domain_admins username as TargetUserName OUTPUT username | fillnull value=NotDA username | search username = "NotDA" | stats count by _time, TargetUserName, GroupMembership, host | `windows_domain_admin_impersonation_indicator_filter`' From 3e07515de2c0a13ac26fd5810237adb1cc9ced54 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 9 Oct 2023 15:14:35 -0400 Subject: [PATCH 5/6] adding analytic story --- .../endpoint/windows_domain_admin_impersonation_indicator.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml index a7200981b8..c82d90909a 100644 --- a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml +++ b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml @@ -23,6 +23,7 @@ references: tags: analytic_story: - Active Directory Kerberos Attacks + - Active Directory Privilege Escalation asset_type: Endpoint confidence: 100 impact: 80 From fb66f993c99d7aee57535a08b896af5cf8c12ad9 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 12 Oct 2023 11:15:44 -0700 Subject: [PATCH 6/6] update source --- .../endpoint/windows_domain_admin_impersonation_indicator.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml index c82d90909a..1adde7fd3b 100644 --- a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml +++ b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml @@ -51,5 +51,5 @@ tests: - name: True Positive Test attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558/diamond_ticket/security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog \ No newline at end of file + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog