AR Microsoft Sentinel Analytic Rules ONLINE

Analytic rule catalog

PROD TM0131 - OU - Block Inheritance was Enabled on an OU

Back
Id17371300-904a-4af5-9550-cf57ee727bb7
RulenamePROD (TM013.1) - OU - Block Inheritance was Enabled on an OU
DescriptionBlocking Inheritance on an OU will deny Tier Model GPOs from applying.
SeverityHigh
TacticsDefenseEvasion
TechniquesT1484.001
Required data connectorsSecurityEvents
WindowsSecurityEvents
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM013_OUBlockInheritanceWasEnabledOnAnOU.yaml
Version1.0.0
Arm template17371300-904a-4af5-9550-cf57ee727bb7.json
Deploy To Azure
SecurityEvent
| where EventID == 5136
    and Activity has "modified"
    and EventData has '"ObjectClass">organizationalUnit'
    and EventData has '<Data Name="AttributeLDAPDisplayName">gPOptions</Data>'
| extend ObjectName = extract("<Data Name=\"ObjectDN\">((?i)OU=[^,]+(,(?i)OU=[^,]+)*),(?i)DC=", 1, EventData)
| extend AttributeLDAP = extract("<Data Name=\"AttributeLDAPDisplayName\">([^<]+)</Data>", 1, EventData)
| extend AttributeValue = extract("<Data Name=\"AttributeValue\">([0-9]+)</Data>", 1, EventData)
| extend ActivityType = case(
    AttributeValue == "1", "Block Inheritance Enabled",
    AttributeValue == "0", "Block Inheritance Disabled",
    "Block Inheritance Modified")
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| project TimeGenerated
    , ObjectName
    , ObjectClass
    , ActivityType
    , AttributeLDAP
    , Account
    , Domain
    , Computer
    , Channel
    , EventID
    , EventData

version: 1.0.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM013_OUBlockInheritanceWasEnabledOnAnOU.yaml
triggerThreshold: 0
requiredDataConnectors:
- dataTypes:
  - SecurityEvent
  connectorId: SecurityEvents
- dataTypes:
  - SecurityEvent
  connectorId: WindowsSecurityEvents
tactics:
- DefenseEvasion
relevantTechniques:
- T1484.001
eventGroupingSettings:
  aggregationKind: AlertPerResult
incidentConfiguration:
  groupingConfiguration:
    matchingMethod: AllEntities
    lookbackDuration: PT5H
    reopenClosedIncident: false
    enabled: false
  createIncident: true
alertDetailsOverride:
  alertDescriptionFormat: Block Inheritance was configured by {{Account}}
  alertDisplayNameFormat: (TM013.1) An OU was configured for Block Inheritance and is overwriting Tier Model GPOs
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: ObjectName
  entityType: Account
- fieldMappings:
  - identifier: HostName
    columnName: Computer
  entityType: Host
- fieldMappings:
  - identifier: FullName
    columnName: Account
  entityType: Account
description: |
  Blocking Inheritance on an OU will deny Tier Model GPOs from applying.
triggerOperator: gt
kind: Scheduled
status: Available
queryFrequency: 5m
id: 17371300-904a-4af5-9550-cf57ee727bb7
name: PROD (TM013.1) - OU - Block Inheritance was Enabled on an OU
severity: High
query: |
  SecurityEvent
  | where EventID == 5136
      and Activity has "modified"
      and EventData has '"ObjectClass">organizationalUnit'
      and EventData has '<Data Name="AttributeLDAPDisplayName">gPOptions</Data>'
  | extend ObjectName = extract("<Data Name=\"ObjectDN\">((?i)OU=[^,]+(,(?i)OU=[^,]+)*),(?i)DC=", 1, EventData)
  | extend AttributeLDAP = extract("<Data Name=\"AttributeLDAPDisplayName\">([^<]+)</Data>", 1, EventData)
  | extend AttributeValue = extract("<Data Name=\"AttributeValue\">([0-9]+)</Data>", 1, EventData)
  | extend ActivityType = case(
      AttributeValue == "1", "Block Inheritance Enabled",
      AttributeValue == "0", "Block Inheritance Disabled",
      "Block Inheritance Modified")
  | extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
  | extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
  | project TimeGenerated
      , ObjectName
      , ObjectClass
      , ActivityType
      , AttributeLDAP
      , Account
      , Domain
      , Computer
      , Channel
      , EventID
      , EventData
queryPeriod: 5m
customDetails:
  Computer: Computer
  EventData: EventData
  ObjectName: ObjectName
  EventID: EventID
  ObjectClass: ObjectClass
  ActivityType: ActivityType
  AttributeLDAP: AttributeLDAP
  Account: Account
  Channel: Channel
  Domain: Domain

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/17371300-904a-4af5-9550-cf57ee727bb7')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/17371300-904a-4af5-9550-cf57ee727bb7')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Block Inheritance was configured by {{Account}}",
          "alertDisplayNameFormat": "(TM013.1) An OU was configured for Block Inheritance and is overwriting Tier Model GPOs"
        },
        "alertRuleTemplateName": "17371300-904a-4af5-9550-cf57ee727bb7",
        "customDetails": {
          "Account": "Account",
          "ActivityType": "ActivityType",
          "AttributeLDAP": "AttributeLDAP",
          "Channel": "Channel",
          "Computer": "Computer",
          "Domain": "Domain",
          "EventData": "EventData",
          "EventID": "EventID",
          "ObjectClass": "ObjectClass",
          "ObjectName": "ObjectName"
        },
        "description": "Blocking Inheritance on an OU will deny Tier Model GPOs from applying.\n",
        "displayName": "PROD (TM013.1) - OU - Block Inheritance was Enabled on an OU",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "ObjectName",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "Computer",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "Account",
                "identifier": "FullName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM013_OUBlockInheritanceWasEnabledOnAnOU.yaml",
        "query": "SecurityEvent\n| where EventID == 5136\n    and Activity has \"modified\"\n    and EventData has '\"ObjectClass\">organizationalUnit'\n    and EventData has '<Data Name=\"AttributeLDAPDisplayName\">gPOptions</Data>'\n| extend ObjectName = extract(\"<Data Name=\\\"ObjectDN\\\">((?i)OU=[^,]+(,(?i)OU=[^,]+)*),(?i)DC=\", 1, EventData)\n| extend AttributeLDAP = extract(\"<Data Name=\\\"AttributeLDAPDisplayName\\\">([^<]+)</Data>\", 1, EventData)\n| extend AttributeValue = extract(\"<Data Name=\\\"AttributeValue\\\">([0-9]+)</Data>\", 1, EventData)\n| extend ActivityType = case(\n    AttributeValue == \"1\", \"Block Inheritance Enabled\",\n    AttributeValue == \"0\", \"Block Inheritance Disabled\",\n    \"Block Inheritance Modified\")\n| extend ObjectClass = extract(\"<Data Name=\\\"ObjectClass\\\">([^<]+)</Data>\", 1, EventData)\n| extend Domain = extract(\"([^.]+\\\\.[^.]+)$\", 1, Computer)\n| project TimeGenerated\n    , ObjectName\n    , ObjectClass\n    , ActivityType\n    , AttributeLDAP\n    , Account\n    , Domain\n    , Computer\n    , Channel\n    , EventID\n    , EventData\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [
          "T1484.001"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion"
        ],
        "techniques": [
          "T1484"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}