From 52c5800476830e29529981fde46832e12054c681 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Fri, 18 Aug 2023 12:54:25 -0700 Subject: [PATCH 1/7] yml and updates --- ...ows_ad_abnormal_object_access_activity.yml | 60 +++++++++++++ ...s_ad_privileged_object_access_activity.yml | 85 +++++++++++++++++++ 2 files changed, 145 insertions(+) create mode 100644 detections/endpoint/windows_ad_abnormal_object_access_activity.yml create mode 100644 detections/endpoint/windows_ad_privileged_object_access_activity.yml diff --git a/detections/endpoint/windows_ad_abnormal_object_access_activity.yml b/detections/endpoint/windows_ad_abnormal_object_access_activity.yml new file mode 100644 index 0000000000..ad520f4985 --- /dev/null +++ b/detections/endpoint/windows_ad_abnormal_object_access_activity.yml @@ -0,0 +1,60 @@ +name: Windows AD Abnormal Object Access Activity +id: 71b289db-5f2c-4c43-8256-8bf26ae7324a +version: 1 +date: '2023-06-01' +author: Steven Dick +status: production +type: TTP +description: Windows Active Directory contains numerous objects. A statistically significant increase in +access to these objects may be evidence of attacker enumeration of Active Directory. +data_source: +- Windows Security Event ID 4662 +search: '`wineventlog_security` EventCode=4662 +| `windows_ad_abnormal_object_access_filter` +| stats min(_time) AS firstTime, max(_time) AS lastTime, dc(ObjectName) AS ObjectName_count, values(ObjectType) AS ObjectType, latest(Computer) AS dest count BY SubjectUserName +| eventstats avg(ObjectName_count) AS average stdev(ObjectName_count) AS standarddev +| eval limit = round((average+(standarddev*3)),0), user = SubjectUserName +| where ObjectName_count > limit +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)`' +how_to_implement: Enable Audit Directory Service Access via GPO and collect event code 4662 for relevant objects. Be aware +Splunk filters this event by default on the Windows TA. Recommend pre-filtering any known service accounts that +frequently query AD to make detection more accurate. Setting wide search window of 48~72hr may smooth out misfires. +known_false_positives: Service accounts or applications that routinely query Active Directory for information. +references: +- https://medium.com/securonix-tech-blog/detecting-ldap-enumeration-and-bloodhound-s-sharphound-collector-using-active-directory-decoys-dfc840f2f644 +- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662 +tags: + analytic_story: + - Active Directory Discovery + asset_type: Endpoint + confidence: 50 + impact: 50 + message: The account $user$ accessed an abnormal amount ($ObjectName_count$) of [$ObjectType$] AD object(s) between $firstTime$ and $lastTime$. + mitre_attack_id: + - T1087 + - T1087.002 + observable: + - name: user + type: Username + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - ObjectName + - EventCode + - SubjectUserName + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/4662_ad_enum/4662_priv_events.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + update_timestamp: true \ No newline at end of file diff --git a/detections/endpoint/windows_ad_privileged_object_access_activity.yml b/detections/endpoint/windows_ad_privileged_object_access_activity.yml new file mode 100644 index 0000000000..62d49b4f2a --- /dev/null +++ b/detections/endpoint/windows_ad_privileged_object_access_activity.yml @@ -0,0 +1,85 @@ +name: Windows AD Privileged Object Access Activity +id: dc2f58bc-8cd2-4e51-962a-694b963acde0 +version: 1 +date: '2023-06-01' +author: Steven Dick +status: production +type: TTP +description: Windows Active Directory contains numerous objects that grant elevated access to the +domain they reside in. These objects should be rarely accessed by normal users or processes. Access +attempts to one or more of these objects may be evidence of attacker enumeration of Active Directory. +data_source: +- Windows Security Event ID 4662 +search: '`wineventlog_security` EventCode=4662 ObjectName IN ( +"CN=Account Operators,*", +"CN=Administrators,*", +"CN=Backup Operators,*", +"CN=Cert Publishers,*", +"CN=Certificate Service DCOM Access,*", +"CN=Domain Admins,*", +"CN=Domain Controllers,*", +"CN=Enterprise Admins,*", +"CN=Enterprise Read-only Domain Controllers,*", +"CN=Group Policy Creator Owners,*", +"CN=Incoming Forest Trust Builders,*", +"CN=Microsoft Exchange Servers,*", +"CN=Network Configuration Operators,*", +"CN=Power Users,*", +"CN=Print Operators,*", +"CN=Read-only Domain Controllers,*", +"CN=Replicators,*", +"CN=Schema Admins,*", +"CN=Server Operators,*", +"CN=Exchange Trusted Subsystem,*", +"CN=Exchange Windows Permission,*", +"CN=Organization Management,*") +| rex field=ObjectName "CN\=(?[^,]+)" +| stats values(Computer) as dest, values(object_name) as object_name, dc(ObjectName) as object_count, min(_time) as firstTime, max(_time) as lastTime, count by SubjectUserName +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| eval user = SubjectUserName, risk_score = case(object_count=1,40,object_count>1,object_count*30,true(),40) +| `windows_ad_privileged_object_access_filter`' +how_to_implement: Enable Audit Directory Service Access via GPO and collect event code 4662 for relevant objects. Be aware +Splunk filters this event by default on the Windows TA. +known_false_positives: Service accounts or applications that routinely query Active Directory for information. +references: +- https://medium.com/securonix-tech-blog/detecting-ldap-enumeration-and-bloodhound-s-sharphound-collector-using-active-directory-decoys-dfc840f2f644 +- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662 +tags: + analytic_story: + - Active Directory Discovery + asset_type: Endpoint + confidence: 50 + impact: 50 + message: The account $user$ accessed $object_count$ privileged AD object(s). + mitre_attack_id: + - T1087 + - T1087.002 + observable: + - name: user + type: Username + role: + - Victim + - name: object_name + type: Other + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - ObjectName + - EventCode + - Caller_User_Name + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/4662_ad_enum/4662_priv_events.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + update_timestamp: true \ No newline at end of file From 0fee186fc30ab5a24a7004c23bcea4466482cdd0 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Fri, 18 Aug 2023 12:58:50 -0700 Subject: [PATCH 2/7] fixes --- .../windows_ad_abnormal_object_access_activity.yml | 11 ++++------- .../windows_ad_privileged_object_access_activity.yml | 11 ++++------- 2 files changed, 8 insertions(+), 14 deletions(-) diff --git a/detections/endpoint/windows_ad_abnormal_object_access_activity.yml b/detections/endpoint/windows_ad_abnormal_object_access_activity.yml index ad520f4985..9e21698a6f 100644 --- a/detections/endpoint/windows_ad_abnormal_object_access_activity.yml +++ b/detections/endpoint/windows_ad_abnormal_object_access_activity.yml @@ -5,10 +5,9 @@ date: '2023-06-01' author: Steven Dick status: production type: TTP -description: Windows Active Directory contains numerous objects. A statistically significant increase in -access to these objects may be evidence of attacker enumeration of Active Directory. +description: Windows Active Directory contains numerous objects. A statistically significant increase in access to these objects may be evidence of attacker enumeration of Active Directory. data_source: -- Windows Security Event ID 4662 +- Windows Security 4662 search: '`wineventlog_security` EventCode=4662 | `windows_ad_abnormal_object_access_filter` | stats min(_time) AS firstTime, max(_time) AS lastTime, dc(ObjectName) AS ObjectName_count, values(ObjectType) AS ObjectType, latest(Computer) AS dest count BY SubjectUserName @@ -17,9 +16,7 @@ search: '`wineventlog_security` EventCode=4662 | where ObjectName_count > limit | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' -how_to_implement: Enable Audit Directory Service Access via GPO and collect event code 4662 for relevant objects. Be aware -Splunk filters this event by default on the Windows TA. Recommend pre-filtering any known service accounts that -frequently query AD to make detection more accurate. Setting wide search window of 48~72hr may smooth out misfires. +how_to_implement: Enable Audit Directory Service Access via GPO and collect event code 4662 for relevant objects. Be awaren Splunk filters this event by default on the Windows TA. Recommend pre-filtering any known service accounts that frequently query AD to make detection more accurate. Setting wide search window of 48~72hr may smooth out misfires. known_false_positives: Service accounts or applications that routinely query Active Directory for information. references: - https://medium.com/securonix-tech-blog/detecting-ldap-enumeration-and-bloodhound-s-sharphound-collector-using-active-directory-decoys-dfc840f2f644 @@ -36,7 +33,7 @@ tags: - T1087.002 observable: - name: user - type: Username + type: User Name role: - Victim product: diff --git a/detections/endpoint/windows_ad_privileged_object_access_activity.yml b/detections/endpoint/windows_ad_privileged_object_access_activity.yml index 62d49b4f2a..a91d4c87ab 100644 --- a/detections/endpoint/windows_ad_privileged_object_access_activity.yml +++ b/detections/endpoint/windows_ad_privileged_object_access_activity.yml @@ -5,11 +5,9 @@ date: '2023-06-01' author: Steven Dick status: production type: TTP -description: Windows Active Directory contains numerous objects that grant elevated access to the -domain they reside in. These objects should be rarely accessed by normal users or processes. Access -attempts to one or more of these objects may be evidence of attacker enumeration of Active Directory. +description: Windows Active Directory contains numerous objects that grant elevated access to the domain they reside in. These objects should be rarely accessed by normal users or processes. Access attempts to one or more of these objects may be evidence of attacker enumeration of Active Directory. data_source: -- Windows Security Event ID 4662 +- Windows Security 4662 search: '`wineventlog_security` EventCode=4662 ObjectName IN ( "CN=Account Operators,*", "CN=Administrators,*", @@ -39,8 +37,7 @@ search: '`wineventlog_security` EventCode=4662 ObjectName IN ( | `security_content_ctime(lastTime)` | eval user = SubjectUserName, risk_score = case(object_count=1,40,object_count>1,object_count*30,true(),40) | `windows_ad_privileged_object_access_filter`' -how_to_implement: Enable Audit Directory Service Access via GPO and collect event code 4662 for relevant objects. Be aware -Splunk filters this event by default on the Windows TA. +how_to_implement: Enable Audit Directory Service Access via GPO and collect event code 4662 for relevant objects. Be aware Splunk filters this event by default on the Windows TA. known_false_positives: Service accounts or applications that routinely query Active Directory for information. references: - https://medium.com/securonix-tech-blog/detecting-ldap-enumeration-and-bloodhound-s-sharphound-collector-using-active-directory-decoys-dfc840f2f644 @@ -57,7 +54,7 @@ tags: - T1087.002 observable: - name: user - type: Username + type: User Name role: - Victim - name: object_name From 1cf276183d3bf2b24954d6f855325f7a58432a66 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 12 Sep 2023 14:41:13 -0700 Subject: [PATCH 3/7] Update windows_ad_abnormal_object_access_activity.yml --- .../endpoint/windows_ad_abnormal_object_access_activity.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_ad_abnormal_object_access_activity.yml b/detections/endpoint/windows_ad_abnormal_object_access_activity.yml index 9e21698a6f..92acf505dc 100644 --- a/detections/endpoint/windows_ad_abnormal_object_access_activity.yml +++ b/detections/endpoint/windows_ad_abnormal_object_access_activity.yml @@ -9,13 +9,12 @@ description: Windows Active Directory contains numerous objects. A statistically data_source: - Windows Security 4662 search: '`wineventlog_security` EventCode=4662 -| `windows_ad_abnormal_object_access_filter` | stats min(_time) AS firstTime, max(_time) AS lastTime, dc(ObjectName) AS ObjectName_count, values(ObjectType) AS ObjectType, latest(Computer) AS dest count BY SubjectUserName | eventstats avg(ObjectName_count) AS average stdev(ObjectName_count) AS standarddev | eval limit = round((average+(standarddev*3)),0), user = SubjectUserName | where ObjectName_count > limit | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)`' +| `security_content_ctime(lastTime)`| `windows_ad_abnormal_object_access_activity_filter`' how_to_implement: Enable Audit Directory Service Access via GPO and collect event code 4662 for relevant objects. Be awaren Splunk filters this event by default on the Windows TA. Recommend pre-filtering any known service accounts that frequently query AD to make detection more accurate. Setting wide search window of 48~72hr may smooth out misfires. known_false_positives: Service accounts or applications that routinely query Active Directory for information. references: @@ -54,4 +53,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/4662_ad_enum/4662_priv_events.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog - update_timestamp: true \ No newline at end of file + update_timestamp: true From fbc808c1e3c805868451c91824ddde1828ded36b Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 12 Sep 2023 14:41:57 -0700 Subject: [PATCH 4/7] Update windows_ad_privileged_object_access_activity.yml --- .../endpoint/windows_ad_privileged_object_access_activity.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_ad_privileged_object_access_activity.yml b/detections/endpoint/windows_ad_privileged_object_access_activity.yml index a91d4c87ab..6ee6a6974c 100644 --- a/detections/endpoint/windows_ad_privileged_object_access_activity.yml +++ b/detections/endpoint/windows_ad_privileged_object_access_activity.yml @@ -36,7 +36,7 @@ search: '`wineventlog_security` EventCode=4662 ObjectName IN ( | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | eval user = SubjectUserName, risk_score = case(object_count=1,40,object_count>1,object_count*30,true(),40) -| `windows_ad_privileged_object_access_filter`' +| `windows_ad_privileged_object_access_activity_filter`' how_to_implement: Enable Audit Directory Service Access via GPO and collect event code 4662 for relevant objects. Be aware Splunk filters this event by default on the Windows TA. known_false_positives: Service accounts or applications that routinely query Active Directory for information. references: @@ -79,4 +79,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/4662_ad_enum/4662_priv_events.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog - update_timestamp: true \ No newline at end of file + update_timestamp: true From c6b398bd73a719202b5025cff36bd05c702110d7 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 13 Sep 2023 13:58:28 -0700 Subject: [PATCH 5/7] Update windows_ad_abnormal_object_access_activity.yml --- .../endpoint/windows_ad_abnormal_object_access_activity.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_ad_abnormal_object_access_activity.yml b/detections/endpoint/windows_ad_abnormal_object_access_activity.yml index 92acf505dc..b6959b8ba6 100644 --- a/detections/endpoint/windows_ad_abnormal_object_access_activity.yml +++ b/detections/endpoint/windows_ad_abnormal_object_access_activity.yml @@ -32,7 +32,7 @@ tags: - T1087.002 observable: - name: user - type: User Name + type: User role: - Victim product: From 4abb1eafe851fb2ce959b6da0c8fb1b499e78ecf Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 13 Sep 2023 14:00:42 -0700 Subject: [PATCH 6/7] Update windows_ad_privileged_object_access_activity.yml --- .../windows_ad_privileged_object_access_activity.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_ad_privileged_object_access_activity.yml b/detections/endpoint/windows_ad_privileged_object_access_activity.yml index 6ee6a6974c..376d8485eb 100644 --- a/detections/endpoint/windows_ad_privileged_object_access_activity.yml +++ b/detections/endpoint/windows_ad_privileged_object_access_activity.yml @@ -54,7 +54,7 @@ tags: - T1087.002 observable: - name: user - type: User Name + type: User role: - Victim - name: object_name @@ -70,7 +70,8 @@ tags: - EventCode - ObjectName - EventCode - - Caller_User_Name + - Computer + - SubjectUserName risk_score: 25 security_domain: endpoint tests: From e623806a7ac4c9809520183080af377e5cc21019 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 14 Sep 2023 15:45:05 -0400 Subject: [PATCH 7/7] minor fixes --- .../endpoint/windows_ad_abnormal_object_access_activity.yml | 5 +++-- .../windows_ad_privileged_object_access_activity.yml | 3 ++- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_ad_abnormal_object_access_activity.yml b/detections/endpoint/windows_ad_abnormal_object_access_activity.yml index b6959b8ba6..c29605aa9c 100644 --- a/detections/endpoint/windows_ad_abnormal_object_access_activity.yml +++ b/detections/endpoint/windows_ad_abnormal_object_access_activity.yml @@ -4,7 +4,7 @@ version: 1 date: '2023-06-01' author: Steven Dick status: production -type: TTP +type: Anomaly description: Windows Active Directory contains numerous objects. A statistically significant increase in access to these objects may be evidence of attacker enumeration of Active Directory. data_source: - Windows Security 4662 @@ -15,11 +15,12 @@ search: '`wineventlog_security` EventCode=4662 | where ObjectName_count > limit | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_ad_abnormal_object_access_activity_filter`' -how_to_implement: Enable Audit Directory Service Access via GPO and collect event code 4662 for relevant objects. Be awaren Splunk filters this event by default on the Windows TA. Recommend pre-filtering any known service accounts that frequently query AD to make detection more accurate. Setting wide search window of 48~72hr may smooth out misfires. +how_to_implement: Enable Audit Directory Service Access via GPO and collect event code 4662. The required SACLs need to be created for the relevant objects. Be aware Splunk filters this event by default on the Windows TA. Recommend pre-filtering any known service accounts that frequently query AD to make detection more accurate. Setting wide search window of 48~72hr may smooth out misfires. known_false_positives: Service accounts or applications that routinely query Active Directory for information. references: - https://medium.com/securonix-tech-blog/detecting-ldap-enumeration-and-bloodhound-s-sharphound-collector-using-active-directory-decoys-dfc840f2f644 - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662 +- https://attack.mitre.org/tactics/TA0007/ tags: analytic_story: - Active Directory Discovery diff --git a/detections/endpoint/windows_ad_privileged_object_access_activity.yml b/detections/endpoint/windows_ad_privileged_object_access_activity.yml index 376d8485eb..0bebe89a2b 100644 --- a/detections/endpoint/windows_ad_privileged_object_access_activity.yml +++ b/detections/endpoint/windows_ad_privileged_object_access_activity.yml @@ -37,11 +37,12 @@ search: '`wineventlog_security` EventCode=4662 ObjectName IN ( | `security_content_ctime(lastTime)` | eval user = SubjectUserName, risk_score = case(object_count=1,40,object_count>1,object_count*30,true(),40) | `windows_ad_privileged_object_access_activity_filter`' -how_to_implement: Enable Audit Directory Service Access via GPO and collect event code 4662 for relevant objects. Be aware Splunk filters this event by default on the Windows TA. +how_to_implement: Enable Audit Directory Service Access via GPO and collect event code 4662. The required SACLs need to be created for the relevant objects. Be aware Splunk filters this event by default on the Windows TA. known_false_positives: Service accounts or applications that routinely query Active Directory for information. references: - https://medium.com/securonix-tech-blog/detecting-ldap-enumeration-and-bloodhound-s-sharphound-collector-using-active-directory-decoys-dfc840f2f644 - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662 +- https://attack.mitre.org/tactics/TA0007/ tags: analytic_story: - Active Directory Discovery