Semperis DSP Mimikatzs DCShadow Alert

Back


Id	1a6d0a49-64b3-4ca1-96c3-f154c16c218c
Rulename	Semperis DSP Mimikatz’s DCShadow Alert
Description	Mimikatz’s DCShadow switch allows a user who has compromised an AD domain, to inject arbitrary changes into AD using a “fake” domain controller. These changes bypass the security event log and can’t be spotted using normal AD tools. This rule looks for evidence that a machine has been used in this capacity.
Severity	High
Tactics	DefenseEvasion
Techniques	T1207
Required data connectors	SemperisDSP
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Semperis Directory Services Protector/Analytic Rules/SemperisDSP_EvidenceOfMimikatzDCShadowAttack.yaml
Version	2.0.7
Arm template	1a6d0a49-64b3-4ca1-96c3-f154c16c218c.json

KQL

dsp_parser
| where EventID == 9212
| where SecurityIndicatorName == "Evidence of Mimikatz DCShadow attack"
| extend HostName = tostring(split(Computer, '.', 0)[0]), DnsDomain = tostring(strcat_array(array_slice(split(Computer, '.'), 1, -1), '.'))

YAML

relevantTechniques:
- T1207
queryFrequency: 1h
description: |
    'Mimikatz's DCShadow switch allows a user who has compromised an AD domain, to inject arbitrary changes into AD using a "fake" domain controller. These changes bypass the security event log and can't be spotted using normal AD tools. This rule looks for evidence that a machine has been used in this capacity.'
severity: High
entityMappings:
- fieldMappings:
  - identifier: HostName
    columnName: HostName
  - identifier: DnsDomain
    columnName: DnsDomain
  entityType: Host
triggerThreshold: 0
tactics:
- DefenseEvasion
requiredDataConnectors:
- dataTypes:
  - dsp_parser
  connectorId: SemperisDSP
queryPeriod: 1h
id: 1a6d0a49-64b3-4ca1-96c3-f154c16c218c
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Semperis Directory Services Protector/Analytic Rules/SemperisDSP_EvidenceOfMimikatzDCShadowAttack.yaml
query: |
  dsp_parser
  | where EventID == 9212
  | where SecurityIndicatorName == "Evidence of Mimikatz DCShadow attack"
  | extend HostName = tostring(split(Computer, '.', 0)[0]), DnsDomain = tostring(strcat_array(array_slice(split(Computer, '.'), 1, -1), '.'))  
name: Semperis DSP Mimikatz's DCShadow Alert
version: 2.0.7
kind: Scheduled
status: Available

ARM