Analytic rule catalog
PROD TM0031 - OBJECT - Moved or Recovered a Tier Level Account
Back
| Id | 1d858e12-777d-4156-b0af-b5ef410739e6 |
| Rulename | PROD (TM003.1) - OBJECT - Moved or Recovered a Tier Level Account |
| Description | Moving or Recovering of a Tier Model object. |
| Severity | Medium |
| Tactics | Persistence |
| Techniques | T1078.002 |
| Required data connectors | SecurityEvents WindowsSecurityEvents |
| Kind | Scheduled |
| Query frequency | 30m |
| Query period | 30m |
| Trigger threshold | 0 |
| Trigger operator | gt |
| Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM003_OBJECTMovedOrRecoveredATierLevelAccount.yaml |
| Version | 1.0.0 |
| Arm template | 1d858e12-777d-4156-b0af-b5ef410739e6.json |
SecurityEvent
| where (EventID == 5138
or EventID == 5139)
and (EventData matches regex @"(?i)OU=Domain Controllers"
or EventData matches regex @"(?i)OU=Tier 0 Accounts"
or EventData matches regex @"(?i)OU=Tier 1 Accounts"
or EventData matches regex @"(?i)OU=Tier 2 Accounts"
or EventData matches regex @"(?i)OU=Tier 0 Service Accounts"
or EventData matches regex @"(?i)OU=Tier 1 Service Accounts"
or EventData matches regex @"(?i)OU=Tier 2 Service Accounts"
or EventData matches regex @"(?i)OU=Tier 0 Groups"
or EventData matches regex @"(?i)OU=Tier 1 Groups"
or EventData matches regex @"(?i)OU=Tier 2 Groups"
or EventData matches regex @"(?i)OU=Tier 0 PAW"
or EventData matches regex @"(?i)OU=Tier 1 PAW"
or EventData matches regex @"(?i)OU=Tier 2 PAW"
or EventData matches regex @"(?i)OU=Tier 0 Member Servers"
or EventData matches regex @"(?i)OU=Tier 1 Member Servers")
| extend OldObject_e = extract("<Data Name=\"OldObjectDN\">([^<]+)</Data>", 1, EventData)
| extend OldObject = extract("(?i)CN=([^,]+)", 1, OldObject_e)
| extend OldObjectTier = extract("(?i)OU=(Tier [^ ]+)", 1, OldObject_e)
| extend OldObjectTier = iff(isempty(OldObjectTier), "Outside Tier Model", OldObjectTier)
| extend NewObject_e = extract("<Data Name=\"NewObjectDN\">([^<]+)</Data>", 1, EventData)
| extend NewObject = extract("(?i)CN=([^,]+)", 1, NewObject_e)
| extend NewObjectTier = extract("(?i)OU=(Tier [^ ]+)", 1, NewObject_e)
| extend SubjectUserName = extract("<Data Name=\"SubjectUserName\">([^<]+)</Data>", 1, EventData)
| extend SubjectDomainName = extract("<Data Name=\"SubjectDomainName\">([^<]+)</Data>", 1, EventData)
| extend Account = strcat(SubjectDomainName, "\\", SubjectUserName)
| extend NewObjectTier = iff(isempty(NewObjectTier),
iff(NewObject_e matches regex @"(?i)OU=Domain Controllers", "Tier 0", "Outside Tier Model"),
NewObjectTier)
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| where OldObject != NewObjectTier
| project TimeGenerated
, ObjectName = OldObject
, NewObjectTier
, NewObjectOU = NewObject_e
, ObjectClass
, PreviousTier = OldObjectTier
, PreviousOU = OldObject_e
, ActivityType
, Account
, Domain
, Computer
, Channel
, EventID
, EventData
incidentConfiguration:
groupingConfiguration:
lookbackDuration: PT5H
reopenClosedIncident: false
matchingMethod: AllEntities
enabled: false
createIncident: true
name: PROD (TM003.1) - OBJECT - Moved or Recovered a Tier Level Account
triggerOperator: gt
query: |
SecurityEvent
| where (EventID == 5138
or EventID == 5139)
and (EventData matches regex @"(?i)OU=Domain Controllers"
or EventData matches regex @"(?i)OU=Tier 0 Accounts"
or EventData matches regex @"(?i)OU=Tier 1 Accounts"
or EventData matches regex @"(?i)OU=Tier 2 Accounts"
or EventData matches regex @"(?i)OU=Tier 0 Service Accounts"
or EventData matches regex @"(?i)OU=Tier 1 Service Accounts"
or EventData matches regex @"(?i)OU=Tier 2 Service Accounts"
or EventData matches regex @"(?i)OU=Tier 0 Groups"
or EventData matches regex @"(?i)OU=Tier 1 Groups"
or EventData matches regex @"(?i)OU=Tier 2 Groups"
or EventData matches regex @"(?i)OU=Tier 0 PAW"
or EventData matches regex @"(?i)OU=Tier 1 PAW"
or EventData matches regex @"(?i)OU=Tier 2 PAW"
or EventData matches regex @"(?i)OU=Tier 0 Member Servers"
or EventData matches regex @"(?i)OU=Tier 1 Member Servers")
| extend OldObject_e = extract("<Data Name=\"OldObjectDN\">([^<]+)</Data>", 1, EventData)
| extend OldObject = extract("(?i)CN=([^,]+)", 1, OldObject_e)
| extend OldObjectTier = extract("(?i)OU=(Tier [^ ]+)", 1, OldObject_e)
| extend OldObjectTier = iff(isempty(OldObjectTier), "Outside Tier Model", OldObjectTier)
| extend NewObject_e = extract("<Data Name=\"NewObjectDN\">([^<]+)</Data>", 1, EventData)
| extend NewObject = extract("(?i)CN=([^,]+)", 1, NewObject_e)
| extend NewObjectTier = extract("(?i)OU=(Tier [^ ]+)", 1, NewObject_e)
| extend SubjectUserName = extract("<Data Name=\"SubjectUserName\">([^<]+)</Data>", 1, EventData)
| extend SubjectDomainName = extract("<Data Name=\"SubjectDomainName\">([^<]+)</Data>", 1, EventData)
| extend Account = strcat(SubjectDomainName, "\\", SubjectUserName)
| extend NewObjectTier = iff(isempty(NewObjectTier),
iff(NewObject_e matches regex @"(?i)OU=Domain Controllers", "Tier 0", "Outside Tier Model"),
NewObjectTier)
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| where OldObject != NewObjectTier
| project TimeGenerated
, ObjectName = OldObject
, NewObjectTier
, NewObjectOU = NewObject_e
, ObjectClass
, PreviousTier = OldObjectTier
, PreviousOU = OldObject_e
, ActivityType
, Account
, Domain
, Computer
, Channel
, EventID
, EventData
queryFrequency: 30m
description: |
Moving or Recovering of a Tier Model object.
id: 1d858e12-777d-4156-b0af-b5ef410739e6
triggerThreshold: 0
queryPeriod: 30m
version: 1.0.0
kind: Scheduled
customDetails:
ActivityType: ActivityType
Computer: Computer
PreviousOU: PreviousOU
ObjectName: ObjectName
EventID: EventID
ObjectClass: ObjectClass
EventData: EventData
Account: Account
NewObjectTier: NewObjectTier
NewObjectOU: NewObjectOU
Domain: Domain
PreviousTier: PreviousTier
Channel: Channel
status: Available
eventGroupingSettings:
aggregationKind: AlertPerResult
severity: Medium
requiredDataConnectors:
- connectorId: SecurityEvents
dataTypes:
- SecurityEvent
- connectorId: WindowsSecurityEvents
dataTypes:
- SecurityEvent
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM003_OBJECTMovedOrRecoveredATierLevelAccount.yaml
alertDetailsOverride:
alertDescriptionFormat: '{{ObjectName}} was moved from {{PreviousOU}} to the following OU {{NewObjectOU}}.'
alertDisplayNameFormat: (TM003.1) A {{NewObjectTier}} {{ObjectClass}} was {{ActivityType}}
relevantTechniques:
- T1078.002
tactics:
- Persistence
entityMappings:
- fieldMappings:
- identifier: FullName
columnName: ObjectName
entityType: Account
- fieldMappings:
- identifier: HostName
columnName: Computer
entityType: Host
- fieldMappings:
- identifier: FullName
columnName: Account
entityType: Account
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/1d858e12-777d-4156-b0af-b5ef410739e6')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/1d858e12-777d-4156-b0af-b5ef410739e6')]",
"properties": {
"alertDetailsOverride": {
"alertDescriptionFormat": "{{ObjectName}} was moved from {{PreviousOU}} to the following OU {{NewObjectOU}}.",
"alertDisplayNameFormat": "(TM003.1) A {{NewObjectTier}} {{ObjectClass}} was {{ActivityType}}"
},
"alertRuleTemplateName": "1d858e12-777d-4156-b0af-b5ef410739e6",
"customDetails": {
"Account": "Account",
"ActivityType": "ActivityType",
"Channel": "Channel",
"Computer": "Computer",
"Domain": "Domain",
"EventData": "EventData",
"EventID": "EventID",
"NewObjectOU": "NewObjectOU",
"NewObjectTier": "NewObjectTier",
"ObjectClass": "ObjectClass",
"ObjectName": "ObjectName",
"PreviousOU": "PreviousOU",
"PreviousTier": "PreviousTier"
},
"description": "Moving or Recovering of a Tier Model object.\n",
"displayName": "PROD (TM003.1) - OBJECT - Moved or Recovered a Tier Level Account",
"enabled": true,
"entityMappings": [
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "ObjectName",
"identifier": "FullName"
}
]
},
{
"entityType": "Host",
"fieldMappings": [
{
"columnName": "Computer",
"identifier": "HostName"
}
]
},
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "Account",
"identifier": "FullName"
}
]
}
],
"eventGroupingSettings": {
"aggregationKind": "AlertPerResult"
},
"incidentConfiguration": {
"createIncident": true,
"groupingConfiguration": {
"enabled": false,
"lookbackDuration": "PT5H",
"matchingMethod": "AllEntities",
"reopenClosedIncident": false
}
},
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM003_OBJECTMovedOrRecoveredATierLevelAccount.yaml",
"query": "SecurityEvent \n| where (EventID == 5138\n or EventID == 5139)\n and (EventData matches regex @\"(?i)OU=Domain Controllers\"\n or EventData matches regex @\"(?i)OU=Tier 0 Accounts\" \n or EventData matches regex @\"(?i)OU=Tier 1 Accounts\" \n or EventData matches regex @\"(?i)OU=Tier 2 Accounts\"\n or EventData matches regex @\"(?i)OU=Tier 0 Service Accounts\" \n or EventData matches regex @\"(?i)OU=Tier 1 Service Accounts\" \n or EventData matches regex @\"(?i)OU=Tier 2 Service Accounts\"\n or EventData matches regex @\"(?i)OU=Tier 0 Groups\"\n or EventData matches regex @\"(?i)OU=Tier 1 Groups\"\n or EventData matches regex @\"(?i)OU=Tier 2 Groups\"\n or EventData matches regex @\"(?i)OU=Tier 0 PAW\"\n or EventData matches regex @\"(?i)OU=Tier 1 PAW\"\n or EventData matches regex @\"(?i)OU=Tier 2 PAW\"\n or EventData matches regex @\"(?i)OU=Tier 0 Member Servers\"\n or EventData matches regex @\"(?i)OU=Tier 1 Member Servers\")\n| extend OldObject_e = extract(\"<Data Name=\\\"OldObjectDN\\\">([^<]+)</Data>\", 1, EventData)\n| extend OldObject = extract(\"(?i)CN=([^,]+)\", 1, OldObject_e)\n| extend OldObjectTier = extract(\"(?i)OU=(Tier [^ ]+)\", 1, OldObject_e)\n| extend OldObjectTier = iff(isempty(OldObjectTier), \"Outside Tier Model\", OldObjectTier)\n| extend NewObject_e = extract(\"<Data Name=\\\"NewObjectDN\\\">([^<]+)</Data>\", 1, EventData)\n| extend NewObject = extract(\"(?i)CN=([^,]+)\", 1, NewObject_e)\n| extend NewObjectTier = extract(\"(?i)OU=(Tier [^ ]+)\", 1, NewObject_e)\n| extend SubjectUserName = extract(\"<Data Name=\\\"SubjectUserName\\\">([^<]+)</Data>\", 1, EventData)\n| extend SubjectDomainName = extract(\"<Data Name=\\\"SubjectDomainName\\\">([^<]+)</Data>\", 1, EventData)\n| extend Account = strcat(SubjectDomainName, \"\\\\\", SubjectUserName)\n| extend NewObjectTier = iff(isempty(NewObjectTier), \n iff(NewObject_e matches regex @\"(?i)OU=Domain Controllers\", \"Tier 0\", \"Outside Tier Model\"), \n NewObjectTier)\n| extend ObjectClass = extract(\"<Data Name=\\\"ObjectClass\\\">([^<]+)</Data>\", 1, EventData)\n| extend ActivityType = extract(\"([a-zA-Z]+)\\\\.$\", 1, Activity)\n| extend Domain = extract(\"([^.]+\\\\.[^.]+)$\", 1, Computer)\n| where OldObject != NewObjectTier\n| project TimeGenerated\n , ObjectName = OldObject\n , NewObjectTier\n , NewObjectOU = NewObject_e\n , ObjectClass\n , PreviousTier = OldObjectTier\n , PreviousOU = OldObject_e\n , ActivityType\n , Account\n , Domain\n , Computer\n , Channel\n , EventID\n , EventData\n",
"queryFrequency": "PT30M",
"queryPeriod": "PT30M",
"severity": "Medium",
"status": "Available",
"subTechniques": [
"T1078.002"
],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"Persistence"
],
"techniques": [
"T1078"
],
"templateVersion": "1.0.0",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}