Analytic rule catalog
PROD TM0051 - GPO - Linked Unlinked or Enforced at Tier Level OU
Back
| Id | 02cf2172-0eb7-4a4a-bce7-7251cdd3e233 |
| Rulename | PROD (TM005.1) - GPO - Linked, Unlinked, or Enforced at Tier Level OU |
| Description | Linking, Unlinking, or Enforcing of a GPO within the Tier Level OU structure |
| Severity | High |
| Tactics | DefenseEvasion |
| Techniques | T1484.001 |
| Required data connectors | SecurityEvents WindowsSecurityEvents |
| Kind | Scheduled |
| Query frequency | 5m |
| Query period | 5m |
| Trigger threshold | 0 |
| Trigger operator | gt |
| Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM005_GPOLinkedUnlinkedOrEnforcedAtTierLevelOU.yaml |
| Version | 1.0.0 |
| Arm template | 02cf2172-0eb7-4a4a-bce7-7251cdd3e233.json |
SecurityEvent
| where EventID == 5136
and (EventData matches regex @"(?i)OU=Domain Controllers"
or EventData matches regex @"(?i)OU=Tier 0 Member Servers"
or EventData matches regex @"(?i)OU=Tier 1 Member Servers"
or EventData matches regex @"(?i)OU=Tier 2 End-User Accounts"
or EventData matches regex @"(?i)OU=Tier 2 End-User Devices"
or EventData matches regex @"(?i)OU=Tier 2 End-User Groups"
or EventData matches regex @"(?i)OU=Tier Model Administration"
or EventData matches regex @"(?i)OU=Tier Model Computer Quarantine")
and Activity has "modified"
and EventData has '"ObjectClass">organizationalUnit'
and EventData has '<Data Name="AttributeLDAPDisplayName">gPLink</Data>'
and (EventData has ';0]'
or EventData has ';1]'
or EventData has ';2]')
and EventData has '"OperationType">%%14674'
| extend ObjectName = extract("<Data Name=\"ObjectDN\">(((?i)OU=[^,]+,?)+),(?i)DC=", 1, EventData)
| extend ObjectTier = case(
ObjectName has "Tier 0", "Tier 0",
ObjectName has "Tier 1", "Tier 1",
ObjectName has "Tier 2", "Tier 2",
ObjectName has "Tier Model Administration", "Tier 0",
ObjectName has "Tier Model Computer Quarantine", "Tier 0",
ObjectName has "Domain Controllers", "Tier 0",
"Unknown")
| extend AttributeLDAP = extract("<Data Name=\"AttributeLDAPDisplayName\">([^<]+)</Data>", 1, EventData)
| extend AttributeValue = extract("\\[([^\\]]+)\\]", 1, EventData)
| extend LastThreeChars = substring(AttributeValue, strlen(AttributeValue) - 2, 3)
| extend AttributeValueDescription = case(
LastThreeChars == ";0", "Linked",
LastThreeChars == ";1", "Unlinked",
LastThreeChars == ";2", "Enforced",
"Unknown")
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| project TimeGenerated
, ObjectName
, ObjectTier
, ObjectClass
, ActivityType = AttributeValueDescription
, AttributeLDAP
, Account
, Domain
, Computer
, Channel
, EventID
, EventData
incidentConfiguration:
groupingConfiguration:
lookbackDuration: PT5H
reopenClosedIncident: false
matchingMethod: AllEntities
enabled: false
createIncident: true
name: PROD (TM005.1) - GPO - Linked, Unlinked, or Enforced at Tier Level OU
triggerOperator: gt
query: |
SecurityEvent
| where EventID == 5136
and (EventData matches regex @"(?i)OU=Domain Controllers"
or EventData matches regex @"(?i)OU=Tier 0 Member Servers"
or EventData matches regex @"(?i)OU=Tier 1 Member Servers"
or EventData matches regex @"(?i)OU=Tier 2 End-User Accounts"
or EventData matches regex @"(?i)OU=Tier 2 End-User Devices"
or EventData matches regex @"(?i)OU=Tier 2 End-User Groups"
or EventData matches regex @"(?i)OU=Tier Model Administration"
or EventData matches regex @"(?i)OU=Tier Model Computer Quarantine")
and Activity has "modified"
and EventData has '"ObjectClass">organizationalUnit'
and EventData has '<Data Name="AttributeLDAPDisplayName">gPLink</Data>'
and (EventData has ';0]'
or EventData has ';1]'
or EventData has ';2]')
and EventData has '"OperationType">%%14674'
| extend ObjectName = extract("<Data Name=\"ObjectDN\">(((?i)OU=[^,]+,?)+),(?i)DC=", 1, EventData)
| extend ObjectTier = case(
ObjectName has "Tier 0", "Tier 0",
ObjectName has "Tier 1", "Tier 1",
ObjectName has "Tier 2", "Tier 2",
ObjectName has "Tier Model Administration", "Tier 0",
ObjectName has "Tier Model Computer Quarantine", "Tier 0",
ObjectName has "Domain Controllers", "Tier 0",
"Unknown")
| extend AttributeLDAP = extract("<Data Name=\"AttributeLDAPDisplayName\">([^<]+)</Data>", 1, EventData)
| extend AttributeValue = extract("\\[([^\\]]+)\\]", 1, EventData)
| extend LastThreeChars = substring(AttributeValue, strlen(AttributeValue) - 2, 3)
| extend AttributeValueDescription = case(
LastThreeChars == ";0", "Linked",
LastThreeChars == ";1", "Unlinked",
LastThreeChars == ";2", "Enforced",
"Unknown")
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| project TimeGenerated
, ObjectName
, ObjectTier
, ObjectClass
, ActivityType = AttributeValueDescription
, AttributeLDAP
, Account
, Domain
, Computer
, Channel
, EventID
, EventData
queryFrequency: 5m
description: |
Linking, Unlinking, or Enforcing of a GPO within the Tier Level OU structure
id: 02cf2172-0eb7-4a4a-bce7-7251cdd3e233
triggerThreshold: 0
queryPeriod: 5m
version: 1.0.0
kind: Scheduled
customDetails:
Account: Account
ObjectName: ObjectName
Domain: Domain
Channel: Channel
ActivityType: ActivityType
EventData: EventData
ObjectClass: ObjectClass
ObjectTier: ObjectTier
EventID: EventID
AttributeLDAP: AttributeLDAP
Computer: Computer
status: Available
eventGroupingSettings:
aggregationKind: AlertPerResult
severity: High
requiredDataConnectors:
- connectorId: SecurityEvents
dataTypes:
- SecurityEvent
- connectorId: WindowsSecurityEvents
dataTypes:
- SecurityEvent
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM005_GPOLinkedUnlinkedOrEnforcedAtTierLevelOU.yaml
alertDetailsOverride:
alertDescriptionFormat: This will alert when a GPO is linked, unlinked, or enforced at any of the Tier Model OUs.
alertDisplayNameFormat: (TM005.1) A GPO was {{ActivityType}} at the following {{ObjectTier}} {{ObjectName}} OU
relevantTechniques:
- T1484.001
tactics:
- DefenseEvasion
entityMappings:
- fieldMappings:
- identifier: FullName
columnName: ObjectName
entityType: Account
- fieldMappings:
- identifier: HostName
columnName: Computer
entityType: Host
- fieldMappings:
- identifier: FullName
columnName: Account
entityType: Account
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/02cf2172-0eb7-4a4a-bce7-7251cdd3e233')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/02cf2172-0eb7-4a4a-bce7-7251cdd3e233')]",
"properties": {
"alertDetailsOverride": {
"alertDescriptionFormat": "This will alert when a GPO is linked, unlinked, or enforced at any of the Tier Model OUs.",
"alertDisplayNameFormat": "(TM005.1) A GPO was {{ActivityType}} at the following {{ObjectTier}} {{ObjectName}} OU"
},
"alertRuleTemplateName": "02cf2172-0eb7-4a4a-bce7-7251cdd3e233",
"customDetails": {
"Account": "Account",
"ActivityType": "ActivityType",
"AttributeLDAP": "AttributeLDAP",
"Channel": "Channel",
"Computer": "Computer",
"Domain": "Domain",
"EventData": "EventData",
"EventID": "EventID",
"ObjectClass": "ObjectClass",
"ObjectName": "ObjectName",
"ObjectTier": "ObjectTier"
},
"description": "Linking, Unlinking, or Enforcing of a GPO within the Tier Level OU structure\n",
"displayName": "PROD (TM005.1) - GPO - Linked, Unlinked, or Enforced at Tier Level OU",
"enabled": true,
"entityMappings": [
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "ObjectName",
"identifier": "FullName"
}
]
},
{
"entityType": "Host",
"fieldMappings": [
{
"columnName": "Computer",
"identifier": "HostName"
}
]
},
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "Account",
"identifier": "FullName"
}
]
}
],
"eventGroupingSettings": {
"aggregationKind": "AlertPerResult"
},
"incidentConfiguration": {
"createIncident": true,
"groupingConfiguration": {
"enabled": false,
"lookbackDuration": "PT5H",
"matchingMethod": "AllEntities",
"reopenClosedIncident": false
}
},
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM005_GPOLinkedUnlinkedOrEnforcedAtTierLevelOU.yaml",
"query": "SecurityEvent \n| where EventID == 5136 \n and (EventData matches regex @\"(?i)OU=Domain Controllers\"\n or EventData matches regex @\"(?i)OU=Tier 0 Member Servers\"\n or EventData matches regex @\"(?i)OU=Tier 1 Member Servers\"\n or EventData matches regex @\"(?i)OU=Tier 2 End-User Accounts\"\n or EventData matches regex @\"(?i)OU=Tier 2 End-User Devices\"\n or EventData matches regex @\"(?i)OU=Tier 2 End-User Groups\"\n or EventData matches regex @\"(?i)OU=Tier Model Administration\"\n or EventData matches regex @\"(?i)OU=Tier Model Computer Quarantine\")\n and Activity has \"modified\" \n and EventData has '\"ObjectClass\">organizationalUnit'\n and EventData has '<Data Name=\"AttributeLDAPDisplayName\">gPLink</Data>' \n and (EventData has ';0]' \n or EventData has ';1]' \n or EventData has ';2]')\n and EventData has '\"OperationType\">%%14674'\n| extend ObjectName = extract(\"<Data Name=\\\"ObjectDN\\\">(((?i)OU=[^,]+,?)+),(?i)DC=\", 1, EventData)\n| extend ObjectTier = case(\n ObjectName has \"Tier 0\", \"Tier 0\",\n ObjectName has \"Tier 1\", \"Tier 1\",\n ObjectName has \"Tier 2\", \"Tier 2\",\n ObjectName has \"Tier Model Administration\", \"Tier 0\",\n ObjectName has \"Tier Model Computer Quarantine\", \"Tier 0\",\n ObjectName has \"Domain Controllers\", \"Tier 0\",\n \"Unknown\")\n| extend AttributeLDAP = extract(\"<Data Name=\\\"AttributeLDAPDisplayName\\\">([^<]+)</Data>\", 1, EventData)\n| extend AttributeValue = extract(\"\\\\[([^\\\\]]+)\\\\]\", 1, EventData)\n| extend LastThreeChars = substring(AttributeValue, strlen(AttributeValue) - 2, 3)\n| extend AttributeValueDescription = case(\n LastThreeChars == \";0\", \"Linked\",\n LastThreeChars == \";1\", \"Unlinked\",\n LastThreeChars == \";2\", \"Enforced\",\n \"Unknown\")\n| extend ObjectClass = extract(\"<Data Name=\\\"ObjectClass\\\">([^<]+)</Data>\", 1, EventData)\n| extend Domain = extract(\"([^.]+\\\\.[^.]+)$\", 1, Computer)\n| project TimeGenerated\n , ObjectName\n , ObjectTier\n , ObjectClass\n , ActivityType = AttributeValueDescription\n , AttributeLDAP\n , Account\n , Domain\n , Computer\n , Channel\n , EventID\n , EventData\n",
"queryFrequency": "PT5M",
"queryPeriod": "PT5M",
"severity": "High",
"status": "Available",
"subTechniques": [
"T1484.001"
],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"DefenseEvasion"
],
"techniques": [
"T1484"
],
"templateVersion": "1.0.0",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}