Adding AD self assignment detections

detections/application/windows_ad_add_self_to_group.yml

@@ -0,0 +1,51 @@
+name: Windows AD add Self to Group
+id: 065f2701-b7ea-42f5-9ec4-fbc2261165f9
+version: 1
+date: '2023-12-18'
+author: Dean Luxton
+status: production
+type: TTP
+data_source:
+- UPDATE_DATA_SOURCE
+description: Detect when a user adds themselfs to an AD Group. 
+search: '`wineventlog_security` EventCode IN (4728) 
+  | where user=src_user 
+  | stats min(_time) as _time dc(user) as usercount, values(user) as user values(user_category) as user_category values(src_user_category) as src_user_category values(dvc) as dvc by signature, Group_Name, src_user 
+  | `windows_ad_add_self_to_group_filter`'
+how_to_implement: This analytic requires eventCode 4728 to be ingested.
+known_false_positives: Unknown
+references:
+- REFERENCE
+tags:
+  analytic_story:
+  - Active Directory Privilege Escalation
+  - Sneaky Active Directory Persistence Tricks
+  asset_type: Endpoint
+  confidence: 100
+  impact: 50
+  message: $user$ added themselves to AD Group $Group_Name$
+  mitre_attack_id:
+  - T1098
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 50
+  required_fields:
+  - EventCode
+  - user
+  - src_user
+  - signature
+  - Group_Name
+  security_domain: audit
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: UPDATE url to dataset
+    source: UPDATE source
+    sourcetype: UPDATE sourcetype

detections/application/windows_ad_dangerous_deny_acl_modification.yml

@@ -76,6 +76,6 @@ tags:
 tests:
   - name: True Positive Test
     attack_data:
-      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/DCShadowPermissions/windows-security-xml.log
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/hidden_object_windows-security-xml.log
         source: XmlWinEventLog:Security
         sourcetype: xmlwineventlog

detections/application/windows_ad_dangerous_group_acl_modification.yml

@@ -77,6 +77,6 @@ tags:
 tests:
   - name: True Positive Test
     attack_data:
-      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/DCShadowPermissions/windows-security-xml.log
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/group_dacl_mod_windows-security-xml.log
         source: XmlWinEventLog:Security
         sourcetype: xmlwineventlog

detections/application/windows_ad_dangerous_user_acl_modification.yml

@@ -77,6 +77,6 @@ tags:
 tests:
   - name: True Positive Test
     attack_data:
-      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/DCShadowPermissions/windows-security-xml.log
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/user_dacl_mod_windows-security-xml.log
         source: XmlWinEventLog:Security
         sourcetype: xmlwineventlog

detections/application/windows_ad_dcshadow_privileges_acl_addition.yml

@@ -47,6 +47,7 @@ tags:
   mitre_attack_id:
   - T1484
   - T1207
+  - T1222.001
   observable:
     - name: user
       type: User

detections/application/windows_ad_domain_root_acl_deletion.yml

@@ -76,6 +76,6 @@ tags:
 tests:
   - name: True Positive Test
     attack_data:
-      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/DCShadowPermissions/windows-security-xml.log
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/domain_root_acl_deletion_windows-security-xml.log
         source: XmlWinEventLog:Security
         sourcetype: xmlwineventlog

detections/application/windows_ad_domain_root_acl_modification.yml

@@ -76,6 +76,6 @@ tags:
 tests:
   - name: True Positive Test
     attack_data:
-      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/DCShadowPermissions/windows-security-xml.log
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/domain_root_acl_mod_windows-security-xml.log
         source: XmlWinEventLog:Security
         sourcetype: xmlwineventlog

detections/application/windows_ad_gpo_deleted.yml

@@ -31,6 +31,7 @@ tags:
   message: GPO $policyName$ was deleted by $src_user$
   mitre_attack_id:
   - T1562.001
+  - T1484.001
   observable:
     - name: src_user
       type: User
@@ -56,6 +57,6 @@ tags:
 tests:
   - name: True Positive Test
     attack_data:
-      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/DCShadowPermissions/windows-security-xml.log
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_created/gpo_deletion_windows-security-xml.log
         source: XmlWinEventLog:Security
         sourcetype: xmlwineventlog

detections/application/windows_ad_gpo_disabled.yml

@@ -26,6 +26,7 @@ tags:
   message: $src_user$ has disabled GPO $policyName$
   mitre_attack_id:
   - T1562.001
+  - T1484.001
   observable:
     - name: src_user
       type: User
@@ -51,7 +52,7 @@ tags:
 tests:
   - name: True Positive Test
     attack_data:
-      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/DCShadowPermissions/windows-security-xml.log
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_created/gpo_disabled_windows-security-xml.log
         source: XmlWinEventLog:Security
         sourcetype: xmlwineventlog
 

detections/application/windows_ad_gpo_new_cse_addition.yml

@@ -35,6 +35,7 @@ tags:
   message: $src_user$ has added new GPO Client Side Extensions $newPolicy$ to the policy $policyName$
   mitre_attack_id:
   - T1484
+  - T1484.001
   - T1222
   - T1222.001
   observable:
@@ -66,6 +67,6 @@ tags:
 tests:
   - name: True Positive Test
     attack_data:
-      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/DCShadowPermissions/windows-security-xml.log
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_created/gpo_new_cse_windows-security-xml.log
         source: XmlWinEventLog:Security
         sourcetype: xmlwineventlog

detections/application/windows_ad_hidden_ou_creation.yml

@@ -7,7 +7,7 @@ status: production
 type: TTP
 data_source:
 - Windows Security 5136
-description: Hidden OU created using an ACL to deny listing the objects residing in the OU. 
+description: This analytic is looking for when an ACL is applied to an OU which denies listing the objects residing in the OU. This activity combined with modifying the owner of the OU will hide AD objects even from domain administrators. 
 search: '`wineventlog_security` EventCode=5136 ObjectClass=organizationalUnit
   | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId 
   | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)" 
@@ -41,7 +41,7 @@ tags:
   asset_type: Endpoint
   confidence: 100
   impact: 100
-  message: $src_user$ has added ACL rights to grant $user$ $aceControlAccessRights$ $aceAccessRights$ to user $ObjectDN$
+  message: $src_user$ has hidden the contents of OU $ObjectDN$ from $user$
   mitre_attack_id:
   - T1484
   - T1222
@@ -75,6 +75,6 @@ tags:
 tests:
   - name: True Positive Test
     attack_data:
-      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/DCShadowPermissions/windows-security-xml.log
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/hidden_ou_windows-security-xml.log
         source: XmlWinEventLog:Security
         sourcetype: xmlwineventlog

detections/application/windows_ad_object_owner_updated.yml

@@ -71,6 +71,6 @@ tags:
 tests:
   - name: True Positive Test
     attack_data:
-      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/DCShadowPermissions/windows-security-xml.log
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/owner_updated_windows-security-xml.log
         source: XmlWinEventLog:Security
         sourcetype: xmlwineventlog

detections/application/user_added_to_privileged_group.yml → detections/application/windows_ad_privileged_group_modification.yml

@@ -1,4 +1,4 @@
-name: User Added to Privileged Group
+name: Windows AD Privileged Group Modification
 id: 187bf937-c436-4c65-bbcb-7539ffe02da1
 version: 1
 date: '2023-09-27'
@@ -9,13 +9,11 @@ data_source:
 - XmlWinEventLog:Security
 description: Detect users added to privileged AD Groups. 
 search: '`wineventlog_security` EventCode IN (4728)
-  | stats min(_time) as _time dc(user) as usercount, values(user) as user values(user_category)
-  as user_category values(src_user_category) as src_user_category by signature, Group_Name,
-  src_user, dest
+  | stats min(_time) as _time dc(user) as usercount, values(user) as user values(user_category) as user_category values(src_user_category) as src_user_category values(dvc) as dvc by signature, Group_Name,src_user
   | lookup admon_groups_def  cn as Group_Name OUTPUT category
-  | where category="privileged" | `user_added_to_privileged_group_filter`'
+  | where category="privileged" | `windows_ad_privileged_group_modification`'
 how_to_implement: This analytic requires eventCode 4728 to be ingested along with the admon_groups_def lookup being configured to include a list of AD groups along with a category to identify privileged groups. 
-  See splunkbase for further details.
+  See splunkbase app listed in the references for further details.
 known_false_positives: None
 references:
 - https://splunkbase.splunk.com/app/6853

detections/application/windows_ad_self_dacl_assignment.yml

@@ -0,0 +1,77 @@
+name: Windows AD Self DACL Assignment
+id: 16132445-da9f-4d03-ad44-56d717dcd67d
+version: 1
+date: '2023-12-18'
+author: Dean Luxton
+status: production
+type: TTP
+data_source:
+- Windows Security 5136
+description: Detect when a user creates a new DACL in AD for their own AD object. 
+search: '`wineventlog_security` EventCode=5136 
+  | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId 
+  | rex field=old_value max_match=10000 "\((?P<old_values>.*?)\)" 
+  | rex field=new_value max_match=10000 "\((?P<new_ace>.*?)\)" 
+  | mvexpand new_ace 
+  | where NOT new_ace IN (old_values) 
+  | rex field=new_ace "(?P<aceType>.*?);(?P<aceFlags>.*?);(?P<aceAccessRights>.*?);(?P<aceObjectGuid>.*?);(?P<aceInheritedTypeGuid>.*?);(?P<aceSid>.*?)$" 
+  | rex max_match=100 field=aceAccessRights "(?P<AccessRights>[A-Z]{2})" 
+  | rex max_match=100 field=aceFlags "(?P<aceFlags>[A-Z]{2})" 
+  | lookup ace_type_lookup.csv ace_type_string as aceType OUTPUT ace_type_value as aceType 
+  | lookup ace_flag_lookup.csv flag_string as aceFlags OUTPUT flag_value as ace_flag_value 
+  | lookup ace_access_rights_lookup.csv access_rights_string as AccessRights OUTPUT access_rights_value 
+  | lookup msad_guid_lookup.csv guid as aceObjectGuid OUTPUT displayName as ControlAccessRights
+      ``` Optional SID resolution lookups 
+  | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user 
+  | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ```
+  | lookup builtin_groups_lookup.csv builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group 
+  | eval aceType=coalesce(ace_type_value,aceType), aceInheritance=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)), user=coalesce(user, group, builtin_group, aceSid) 
+  | stats values(aceType) as aceType values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID 
+  | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",'aceControlAccessRights')
+  | rex field=user "\\\(?P<nt_user>.*?)$"
+  | where lower(src_user)=lower(nt_user)
+  | `windows_ad_self_dacl_assignment_filter`'
+how_to_implement: Ensure you are ingesting AD audit logs, see lantern doc in references for further details. This detection also leverages admon data. Ensure the admon macro is configured with the correct index. 
+known_false_positives: Unknown
+references:
+- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
+tags:
+  analytic_story:
+ tags:
+  analytic_story:
+    - Sneaky Active Directory Persistence Tricks
+  asset_type: Endpoint
+  confidence: 100
+  impact: 80
+  message: $src_user$ has created a DACL on $ObjectDN$ to grant themselves $aceControlAccessRights$ across $aceAccessRights$
+  mitre_attack_id:
+  - T1484
+  - T1098
+  observable:
+    - name: src_user
+      type: User
+      role:
+        - Victim
+  product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+  risk_score: 80
+  required_fields:
+    - _time
+    - OperationType
+    - ObjectDN
+    - OpCorrelationID
+    - src_user
+    - AttributeLDAPDisplayName
+    - AttributeValue
+    - ObjectClass
+    - SubjectLogonId
+    - DSName
+  security_domain: endpoint
+tests:
+  - name: True Positive Test
+    attack_data:
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/aclmodification/windows-security-xml.log
+        source: XmlWinEventLog:Security
+        sourcetype: xmlwineventlog

detections/application/windows_ad_suspicious_attribute_modification.yml

@@ -20,8 +20,6 @@ search: ' `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName IN ("ms
 how_to_implement: This analytic leverages event code 5136, see documentation in references on how to enable logging. 
 known_false_positives: Unknown
 references:
-- https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings
-- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb
 - https://trustedsec.com/blog/a-hitchhackers-guide-to-dacl-based-detections-part-1-a
 - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
 tags:
@@ -32,7 +30,7 @@ tags:
   impact: 100
   message: $src_user$ has added $user$ $aceAccessRights$ ACL rights to $ObjectClass$ $ObjectDN$
   mitre_attack_id:
-  - T1484
+  - T1550
   - T1222
   - T1222.001
   observable: