AR Microsoft Sentinel Analytic Rules ONLINE

Analytic rule catalog

PROD TM0051 - GPO - Linked Unlinked or Enforced at Tier Level OU

Back
Id02cf2172-0eb7-4a4a-bce7-7251cdd3e233
RulenamePROD (TM005.1) - GPO - Linked, Unlinked, or Enforced at Tier Level OU
DescriptionLinking, Unlinking, or Enforcing of a GPO within the Tier Level OU structure
SeverityHigh
TacticsDefenseEvasion
TechniquesT1484.001
Required data connectorsSecurityEvents
WindowsSecurityEvents
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM005_GPOLinkedUnlinkedOrEnforcedAtTierLevelOU.yaml
Version1.0.0
Arm template02cf2172-0eb7-4a4a-bce7-7251cdd3e233.json
Deploy To Azure
SecurityEvent 
| where EventID == 5136 
    and (EventData matches regex @"(?i)OU=Domain Controllers"
        or EventData matches regex @"(?i)OU=Tier 0 Member Servers"
        or EventData matches regex @"(?i)OU=Tier 1 Member Servers"
        or EventData matches regex @"(?i)OU=Tier 2 End-User Accounts"
        or EventData matches regex @"(?i)OU=Tier 2 End-User Devices"
        or EventData matches regex @"(?i)OU=Tier 2 End-User Groups"
        or EventData matches regex @"(?i)OU=Tier Model Administration"
        or EventData matches regex @"(?i)OU=Tier Model Computer Quarantine")
    and Activity has "modified" 
    and EventData has '"ObjectClass">organizationalUnit'
    and EventData has '<Data Name="AttributeLDAPDisplayName">gPLink</Data>' 
    and (EventData has ';0]' 
        or EventData has ';1]' 
        or EventData has ';2]')
    and EventData has '"OperationType">%%14674'
| extend ObjectName = extract("<Data Name=\"ObjectDN\">(((?i)OU=[^,]+,?)+),(?i)DC=", 1, EventData)
| extend ObjectTier = case(
    ObjectName has "Tier 0", "Tier 0",
    ObjectName has "Tier 1", "Tier 1",
    ObjectName has "Tier 2", "Tier 2",
    ObjectName has "Tier Model Administration", "Tier 0",
    ObjectName has "Tier Model Computer Quarantine", "Tier 0",
    ObjectName has "Domain Controllers", "Tier 0",
    "Unknown")
| extend AttributeLDAP = extract("<Data Name=\"AttributeLDAPDisplayName\">([^<]+)</Data>", 1, EventData)
| extend AttributeValue = extract("\\[([^\\]]+)\\]", 1, EventData)
| extend LastThreeChars = substring(AttributeValue, strlen(AttributeValue) - 2, 3)
| extend AttributeValueDescription = case(
    LastThreeChars == ";0", "Linked",
    LastThreeChars == ";1", "Unlinked",
    LastThreeChars == ";2", "Enforced",
    "Unknown")
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| project TimeGenerated
   , ObjectName
   , ObjectTier
   , ObjectClass
   , ActivityType = AttributeValueDescription
   , AttributeLDAP
   , Account
   , Domain
   , Computer
   , Channel
   , EventID
   , EventData

version: 1.0.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM005_GPOLinkedUnlinkedOrEnforcedAtTierLevelOU.yaml
triggerThreshold: 0
requiredDataConnectors:
- dataTypes:
  - SecurityEvent
  connectorId: SecurityEvents
- dataTypes:
  - SecurityEvent
  connectorId: WindowsSecurityEvents
tactics:
- DefenseEvasion
relevantTechniques:
- T1484.001
eventGroupingSettings:
  aggregationKind: AlertPerResult
incidentConfiguration:
  groupingConfiguration:
    matchingMethod: AllEntities
    lookbackDuration: PT5H
    reopenClosedIncident: false
    enabled: false
  createIncident: true
alertDetailsOverride:
  alertDescriptionFormat: This will alert when a GPO is linked, unlinked, or enforced at any of the Tier Model OUs.
  alertDisplayNameFormat: (TM005.1) A GPO was {{ActivityType}} at the following {{ObjectTier}} {{ObjectName}} OU
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: ObjectName
  entityType: Account
- fieldMappings:
  - identifier: HostName
    columnName: Computer
  entityType: Host
- fieldMappings:
  - identifier: FullName
    columnName: Account
  entityType: Account
description: |
  Linking, Unlinking, or Enforcing of a GPO within the Tier Level OU structure
triggerOperator: gt
kind: Scheduled
status: Available
queryFrequency: 5m
id: 02cf2172-0eb7-4a4a-bce7-7251cdd3e233
name: PROD (TM005.1) - GPO - Linked, Unlinked, or Enforced at Tier Level OU
severity: High
query: |
  SecurityEvent 
  | where EventID == 5136 
      and (EventData matches regex @"(?i)OU=Domain Controllers"
          or EventData matches regex @"(?i)OU=Tier 0 Member Servers"
          or EventData matches regex @"(?i)OU=Tier 1 Member Servers"
          or EventData matches regex @"(?i)OU=Tier 2 End-User Accounts"
          or EventData matches regex @"(?i)OU=Tier 2 End-User Devices"
          or EventData matches regex @"(?i)OU=Tier 2 End-User Groups"
          or EventData matches regex @"(?i)OU=Tier Model Administration"
          or EventData matches regex @"(?i)OU=Tier Model Computer Quarantine")
      and Activity has "modified" 
      and EventData has '"ObjectClass">organizationalUnit'
      and EventData has '<Data Name="AttributeLDAPDisplayName">gPLink</Data>' 
      and (EventData has ';0]' 
          or EventData has ';1]' 
          or EventData has ';2]')
      and EventData has '"OperationType">%%14674'
  | extend ObjectName = extract("<Data Name=\"ObjectDN\">(((?i)OU=[^,]+,?)+),(?i)DC=", 1, EventData)
  | extend ObjectTier = case(
      ObjectName has "Tier 0", "Tier 0",
      ObjectName has "Tier 1", "Tier 1",
      ObjectName has "Tier 2", "Tier 2",
      ObjectName has "Tier Model Administration", "Tier 0",
      ObjectName has "Tier Model Computer Quarantine", "Tier 0",
      ObjectName has "Domain Controllers", "Tier 0",
      "Unknown")
  | extend AttributeLDAP = extract("<Data Name=\"AttributeLDAPDisplayName\">([^<]+)</Data>", 1, EventData)
  | extend AttributeValue = extract("\\[([^\\]]+)\\]", 1, EventData)
  | extend LastThreeChars = substring(AttributeValue, strlen(AttributeValue) - 2, 3)
  | extend AttributeValueDescription = case(
      LastThreeChars == ";0", "Linked",
      LastThreeChars == ";1", "Unlinked",
      LastThreeChars == ";2", "Enforced",
      "Unknown")
  | extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
  | extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
  | project TimeGenerated
     , ObjectName
     , ObjectTier
     , ObjectClass
     , ActivityType = AttributeValueDescription
     , AttributeLDAP
     , Account
     , Domain
     , Computer
     , Channel
     , EventID
     , EventData
queryPeriod: 5m
customDetails:
  Computer: Computer
  EventData: EventData
  ObjectName: ObjectName
  EventID: EventID
  ObjectClass: ObjectClass
  ActivityType: ActivityType
  AttributeLDAP: AttributeLDAP
  Account: Account
  Channel: Channel
  Domain: Domain
  ObjectTier: ObjectTier

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/02cf2172-0eb7-4a4a-bce7-7251cdd3e233')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/02cf2172-0eb7-4a4a-bce7-7251cdd3e233')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "This will alert when a GPO is linked, unlinked, or enforced at any of the Tier Model OUs.",
          "alertDisplayNameFormat": "(TM005.1) A GPO was {{ActivityType}} at the following {{ObjectTier}} {{ObjectName}} OU"
        },
        "alertRuleTemplateName": "02cf2172-0eb7-4a4a-bce7-7251cdd3e233",
        "customDetails": {
          "Account": "Account",
          "ActivityType": "ActivityType",
          "AttributeLDAP": "AttributeLDAP",
          "Channel": "Channel",
          "Computer": "Computer",
          "Domain": "Domain",
          "EventData": "EventData",
          "EventID": "EventID",
          "ObjectClass": "ObjectClass",
          "ObjectName": "ObjectName",
          "ObjectTier": "ObjectTier"
        },
        "description": "Linking, Unlinking, or Enforcing of a GPO within the Tier Level OU structure\n",
        "displayName": "PROD (TM005.1) - GPO - Linked, Unlinked, or Enforced at Tier Level OU",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "ObjectName",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "Computer",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "Account",
                "identifier": "FullName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM005_GPOLinkedUnlinkedOrEnforcedAtTierLevelOU.yaml",
        "query": "SecurityEvent \n| where EventID == 5136 \n    and (EventData matches regex @\"(?i)OU=Domain Controllers\"\n        or EventData matches regex @\"(?i)OU=Tier 0 Member Servers\"\n        or EventData matches regex @\"(?i)OU=Tier 1 Member Servers\"\n        or EventData matches regex @\"(?i)OU=Tier 2 End-User Accounts\"\n        or EventData matches regex @\"(?i)OU=Tier 2 End-User Devices\"\n        or EventData matches regex @\"(?i)OU=Tier 2 End-User Groups\"\n        or EventData matches regex @\"(?i)OU=Tier Model Administration\"\n        or EventData matches regex @\"(?i)OU=Tier Model Computer Quarantine\")\n    and Activity has \"modified\" \n    and EventData has '\"ObjectClass\">organizationalUnit'\n    and EventData has '<Data Name=\"AttributeLDAPDisplayName\">gPLink</Data>' \n    and (EventData has ';0]' \n        or EventData has ';1]' \n        or EventData has ';2]')\n    and EventData has '\"OperationType\">%%14674'\n| extend ObjectName = extract(\"<Data Name=\\\"ObjectDN\\\">(((?i)OU=[^,]+,?)+),(?i)DC=\", 1, EventData)\n| extend ObjectTier = case(\n    ObjectName has \"Tier 0\", \"Tier 0\",\n    ObjectName has \"Tier 1\", \"Tier 1\",\n    ObjectName has \"Tier 2\", \"Tier 2\",\n    ObjectName has \"Tier Model Administration\", \"Tier 0\",\n    ObjectName has \"Tier Model Computer Quarantine\", \"Tier 0\",\n    ObjectName has \"Domain Controllers\", \"Tier 0\",\n    \"Unknown\")\n| extend AttributeLDAP = extract(\"<Data Name=\\\"AttributeLDAPDisplayName\\\">([^<]+)</Data>\", 1, EventData)\n| extend AttributeValue = extract(\"\\\\[([^\\\\]]+)\\\\]\", 1, EventData)\n| extend LastThreeChars = substring(AttributeValue, strlen(AttributeValue) - 2, 3)\n| extend AttributeValueDescription = case(\n    LastThreeChars == \";0\", \"Linked\",\n    LastThreeChars == \";1\", \"Unlinked\",\n    LastThreeChars == \";2\", \"Enforced\",\n    \"Unknown\")\n| extend ObjectClass = extract(\"<Data Name=\\\"ObjectClass\\\">([^<]+)</Data>\", 1, EventData)\n| extend Domain = extract(\"([^.]+\\\\.[^.]+)$\", 1, Computer)\n| project TimeGenerated\n   , ObjectName\n   , ObjectTier\n   , ObjectClass\n   , ActivityType = AttributeValueDescription\n   , AttributeLDAP\n   , Account\n   , Domain\n   , Computer\n   , Channel\n   , EventID\n   , EventData\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [
          "T1484.001"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion"
        ],
        "techniques": [
          "T1484"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}