Analytic rule catalog
PROD TM0131 - OU - Block Inheritance was Enabled on an OU
Back
| Id | 17371300-904a-4af5-9550-cf57ee727bb7 |
| Rulename | PROD (TM013.1) - OU - Block Inheritance was Enabled on an OU |
| Description | Blocking Inheritance on an OU will deny Tier Model GPOs from applying. |
| Severity | High |
| Tactics | DefenseEvasion |
| Techniques | T1484.001 |
| Required data connectors | SecurityEvents WindowsSecurityEvents |
| Kind | Scheduled |
| Query frequency | 5m |
| Query period | 5m |
| Trigger threshold | 0 |
| Trigger operator | gt |
| Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM013_OUBlockInheritanceWasEnabledOnAnOU.yaml |
| Version | 1.0.0 |
| Arm template | 17371300-904a-4af5-9550-cf57ee727bb7.json |
SecurityEvent
| where EventID == 5136
and Activity has "modified"
and EventData has '"ObjectClass">organizationalUnit'
and EventData has '<Data Name="AttributeLDAPDisplayName">gPOptions</Data>'
| extend ObjectName = extract("<Data Name=\"ObjectDN\">((?i)OU=[^,]+(,(?i)OU=[^,]+)*),(?i)DC=", 1, EventData)
| extend AttributeLDAP = extract("<Data Name=\"AttributeLDAPDisplayName\">([^<]+)</Data>", 1, EventData)
| extend AttributeValue = extract("<Data Name=\"AttributeValue\">([0-9]+)</Data>", 1, EventData)
| extend ActivityType = case(
AttributeValue == "1", "Block Inheritance Enabled",
AttributeValue == "0", "Block Inheritance Disabled",
"Block Inheritance Modified")
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| project TimeGenerated
, ObjectName
, ObjectClass
, ActivityType
, AttributeLDAP
, Account
, Domain
, Computer
, Channel
, EventID
, EventData
incidentConfiguration:
groupingConfiguration:
lookbackDuration: PT5H
reopenClosedIncident: false
matchingMethod: AllEntities
enabled: false
createIncident: true
name: PROD (TM013.1) - OU - Block Inheritance was Enabled on an OU
triggerOperator: gt
query: |
SecurityEvent
| where EventID == 5136
and Activity has "modified"
and EventData has '"ObjectClass">organizationalUnit'
and EventData has '<Data Name="AttributeLDAPDisplayName">gPOptions</Data>'
| extend ObjectName = extract("<Data Name=\"ObjectDN\">((?i)OU=[^,]+(,(?i)OU=[^,]+)*),(?i)DC=", 1, EventData)
| extend AttributeLDAP = extract("<Data Name=\"AttributeLDAPDisplayName\">([^<]+)</Data>", 1, EventData)
| extend AttributeValue = extract("<Data Name=\"AttributeValue\">([0-9]+)</Data>", 1, EventData)
| extend ActivityType = case(
AttributeValue == "1", "Block Inheritance Enabled",
AttributeValue == "0", "Block Inheritance Disabled",
"Block Inheritance Modified")
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| project TimeGenerated
, ObjectName
, ObjectClass
, ActivityType
, AttributeLDAP
, Account
, Domain
, Computer
, Channel
, EventID
, EventData
queryFrequency: 5m
description: |
Blocking Inheritance on an OU will deny Tier Model GPOs from applying.
id: 17371300-904a-4af5-9550-cf57ee727bb7
triggerThreshold: 0
queryPeriod: 5m
version: 1.0.0
kind: Scheduled
customDetails:
Account: Account
ObjectName: ObjectName
Domain: Domain
Channel: Channel
ActivityType: ActivityType
ObjectClass: ObjectClass
EventData: EventData
EventID: EventID
AttributeLDAP: AttributeLDAP
Computer: Computer
status: Available
eventGroupingSettings:
aggregationKind: AlertPerResult
severity: High
requiredDataConnectors:
- connectorId: SecurityEvents
dataTypes:
- SecurityEvent
- connectorId: WindowsSecurityEvents
dataTypes:
- SecurityEvent
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM013_OUBlockInheritanceWasEnabledOnAnOU.yaml
alertDetailsOverride:
alertDescriptionFormat: Block Inheritance was configured by {{Account}}
alertDisplayNameFormat: (TM013.1) An OU was configured for Block Inheritance and is overwriting Tier Model GPOs
relevantTechniques:
- T1484.001
tactics:
- DefenseEvasion
entityMappings:
- fieldMappings:
- identifier: FullName
columnName: ObjectName
entityType: Account
- fieldMappings:
- identifier: HostName
columnName: Computer
entityType: Host
- fieldMappings:
- identifier: FullName
columnName: Account
entityType: Account
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/17371300-904a-4af5-9550-cf57ee727bb7')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/17371300-904a-4af5-9550-cf57ee727bb7')]",
"properties": {
"alertDetailsOverride": {
"alertDescriptionFormat": "Block Inheritance was configured by {{Account}}",
"alertDisplayNameFormat": "(TM013.1) An OU was configured for Block Inheritance and is overwriting Tier Model GPOs"
},
"alertRuleTemplateName": "17371300-904a-4af5-9550-cf57ee727bb7",
"customDetails": {
"Account": "Account",
"ActivityType": "ActivityType",
"AttributeLDAP": "AttributeLDAP",
"Channel": "Channel",
"Computer": "Computer",
"Domain": "Domain",
"EventData": "EventData",
"EventID": "EventID",
"ObjectClass": "ObjectClass",
"ObjectName": "ObjectName"
},
"description": "Blocking Inheritance on an OU will deny Tier Model GPOs from applying.\n",
"displayName": "PROD (TM013.1) - OU - Block Inheritance was Enabled on an OU",
"enabled": true,
"entityMappings": [
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "ObjectName",
"identifier": "FullName"
}
]
},
{
"entityType": "Host",
"fieldMappings": [
{
"columnName": "Computer",
"identifier": "HostName"
}
]
},
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "Account",
"identifier": "FullName"
}
]
}
],
"eventGroupingSettings": {
"aggregationKind": "AlertPerResult"
},
"incidentConfiguration": {
"createIncident": true,
"groupingConfiguration": {
"enabled": false,
"lookbackDuration": "PT5H",
"matchingMethod": "AllEntities",
"reopenClosedIncident": false
}
},
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM013_OUBlockInheritanceWasEnabledOnAnOU.yaml",
"query": "SecurityEvent\n| where EventID == 5136\n and Activity has \"modified\"\n and EventData has '\"ObjectClass\">organizationalUnit'\n and EventData has '<Data Name=\"AttributeLDAPDisplayName\">gPOptions</Data>'\n| extend ObjectName = extract(\"<Data Name=\\\"ObjectDN\\\">((?i)OU=[^,]+(,(?i)OU=[^,]+)*),(?i)DC=\", 1, EventData)\n| extend AttributeLDAP = extract(\"<Data Name=\\\"AttributeLDAPDisplayName\\\">([^<]+)</Data>\", 1, EventData)\n| extend AttributeValue = extract(\"<Data Name=\\\"AttributeValue\\\">([0-9]+)</Data>\", 1, EventData)\n| extend ActivityType = case(\n AttributeValue == \"1\", \"Block Inheritance Enabled\",\n AttributeValue == \"0\", \"Block Inheritance Disabled\",\n \"Block Inheritance Modified\")\n| extend ObjectClass = extract(\"<Data Name=\\\"ObjectClass\\\">([^<]+)</Data>\", 1, EventData)\n| extend Domain = extract(\"([^.]+\\\\.[^.]+)$\", 1, Computer)\n| project TimeGenerated\n , ObjectName\n , ObjectClass\n , ActivityType\n , AttributeLDAP\n , Account\n , Domain\n , Computer\n , Channel\n , EventID\n , EventData\n",
"queryFrequency": "PT5M",
"queryPeriod": "PT5M",
"severity": "High",
"status": "Available",
"subTechniques": [
"T1484.001"
],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"DefenseEvasion"
],
"techniques": [
"T1484"
],
"templateVersion": "1.0.0",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}