Analytic rule catalog
PROD TM0041 - OBJECT - Enabled Disabled Unlocked or Password Reset of a Tier Level Object
Back
| Id | 1da0cf44-c927-4b6f-9b43-91871b2391b3 |
| Rulename | PROD (TM004.1) - OBJECT - Enabled, Disabled, Unlocked, or Password Reset of a Tier Level Object |
| Description | A Tier Model object has been modified to Enable, Disable, or Unlock of a Tier Level Object. |
| Severity | High |
| Tactics | Persistence |
| Techniques | T1078.002 |
| Required data connectors | SecurityEvents WindowsSecurityEvents |
| Kind | Scheduled |
| Query frequency | 5m |
| Query period | 5m |
| Trigger threshold | 0 |
| Trigger operator | gt |
| Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM004_OBJECTEnabledDisabledUnlockedOrPasswordResetOfATierLevelObje.yaml |
| Version | 1.0.0 |
| Arm template | 1da0cf44-c927-4b6f-9b43-91871b2391b3.json |
SecurityEvent
| where EventID == 5136
and (EventData matches regex @"(?i)OU=Domain Controllers"
or EventData matches regex @"(?i)OU=Tier 0 Accounts"
or EventData matches regex @"(?i)OU=Tier 1 Accounts"
or EventData matches regex @"(?i)OU=Tier 2 Accounts"
or EventData matches regex @"(?i)OU=Tier 0 Service Accounts"
or EventData matches regex @"(?i)OU=Tier 1 Service Accounts"
or EventData matches regex @"(?i)OU=Tier 2 Service Accounts"
or EventData matches regex @"(?i)OU=Tier 0 PAW"
or EventData matches regex @"(?i)OU=Tier 1 PAW"
or EventData matches regex @"(?i)OU=Tier 2 PAW"
or EventData matches regex @"(?i)OU=Tier 0 Member Servers"
or EventData matches regex @"(?i)OU=Tier 1 Member Servers")
and (EventData has 'AttributeValue">512'
or EventData has 'AttributeLDAPDisplayName">userAccountControl'
or EventData has 'AttributeLDAPDisplayName">lockoutTime'
or EventData has 'AttributeLDAPDisplayName">pwdLastSet')
and (EventData has 'AttributeValue">512'
or EventData has 'AttributeValue">514'
or EventData has 'AttributeValue">0'
or EventData has 'AttributeValue">4130'
or EventData has 'AttributeValue">4128')
and EventData has 'OperationType">%%14674'
| extend ObjectName_e = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
| extend ObjectName = extract("(?i)CN=([^,]+)", 1, ObjectName_e)
| extend ObjectTier_e = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
| extend ObjectTier = extract("(?i)OU=(Tier [^ ]+)", 1, ObjectTier_e)
| extend ObjectTier = iff(isempty(ObjectTier),
iff(EventData matches regex @"(?i)OU=Domain Controllers", "Tier 0", "Outside Tier Model"),
ObjectTier)
| extend AttributeLDAP = extract("<Data Name=\"AttributeLDAPDisplayName\">([^<]+)</Data>", 1, EventData)
| extend AttributeValue = extract("<Data Name=\"AttributeValue\">([^<]+)</Data>", 1, EventData)
| extend AttributeValue = iff(EventData has 'AttributeValue">512' or EventData has 'AttributeValue">4128', "Enabled", tostring(AttributeValue))
| extend AttributeValue = iff(EventData has 'AttributeValue">514' or EventData has 'AttributeValue">4130', "Disabled", tostring(AttributeValue))
| extend AttributeValue = iff(EventData has 'AttributeValue">0' and AttributeLDAP == "pwdLastSet", "Password Reset", tostring(AttributeValue))
| extend AttributeValue = iff(EventData has 'AttributeValue">0' and AttributeLDAP == "lockoutTime", "Account Unlocked", tostring(AttributeValue))
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| project TimeGenerated
, ObjectName
, ObjectTier
, ObjectClass
, AttributeValue
, ActivityType
, Account
, Domain
, Computer
, Channel
, EventID
, EventData
incidentConfiguration:
groupingConfiguration:
lookbackDuration: PT5H
reopenClosedIncident: false
matchingMethod: AllEntities
enabled: false
createIncident: true
name: PROD (TM004.1) - OBJECT - Enabled, Disabled, Unlocked, or Password Reset of a Tier Level Object
triggerOperator: gt
query: |
SecurityEvent
| where EventID == 5136
and (EventData matches regex @"(?i)OU=Domain Controllers"
or EventData matches regex @"(?i)OU=Tier 0 Accounts"
or EventData matches regex @"(?i)OU=Tier 1 Accounts"
or EventData matches regex @"(?i)OU=Tier 2 Accounts"
or EventData matches regex @"(?i)OU=Tier 0 Service Accounts"
or EventData matches regex @"(?i)OU=Tier 1 Service Accounts"
or EventData matches regex @"(?i)OU=Tier 2 Service Accounts"
or EventData matches regex @"(?i)OU=Tier 0 PAW"
or EventData matches regex @"(?i)OU=Tier 1 PAW"
or EventData matches regex @"(?i)OU=Tier 2 PAW"
or EventData matches regex @"(?i)OU=Tier 0 Member Servers"
or EventData matches regex @"(?i)OU=Tier 1 Member Servers")
and (EventData has 'AttributeValue">512'
or EventData has 'AttributeLDAPDisplayName">userAccountControl'
or EventData has 'AttributeLDAPDisplayName">lockoutTime'
or EventData has 'AttributeLDAPDisplayName">pwdLastSet')
and (EventData has 'AttributeValue">512'
or EventData has 'AttributeValue">514'
or EventData has 'AttributeValue">0'
or EventData has 'AttributeValue">4130'
or EventData has 'AttributeValue">4128')
and EventData has 'OperationType">%%14674'
| extend ObjectName_e = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
| extend ObjectName = extract("(?i)CN=([^,]+)", 1, ObjectName_e)
| extend ObjectTier_e = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
| extend ObjectTier = extract("(?i)OU=(Tier [^ ]+)", 1, ObjectTier_e)
| extend ObjectTier = iff(isempty(ObjectTier),
iff(EventData matches regex @"(?i)OU=Domain Controllers", "Tier 0", "Outside Tier Model"),
ObjectTier)
| extend AttributeLDAP = extract("<Data Name=\"AttributeLDAPDisplayName\">([^<]+)</Data>", 1, EventData)
| extend AttributeValue = extract("<Data Name=\"AttributeValue\">([^<]+)</Data>", 1, EventData)
| extend AttributeValue = iff(EventData has 'AttributeValue">512' or EventData has 'AttributeValue">4128', "Enabled", tostring(AttributeValue))
| extend AttributeValue = iff(EventData has 'AttributeValue">514' or EventData has 'AttributeValue">4130', "Disabled", tostring(AttributeValue))
| extend AttributeValue = iff(EventData has 'AttributeValue">0' and AttributeLDAP == "pwdLastSet", "Password Reset", tostring(AttributeValue))
| extend AttributeValue = iff(EventData has 'AttributeValue">0' and AttributeLDAP == "lockoutTime", "Account Unlocked", tostring(AttributeValue))
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| project TimeGenerated
, ObjectName
, ObjectTier
, ObjectClass
, AttributeValue
, ActivityType
, Account
, Domain
, Computer
, Channel
, EventID
, EventData
queryFrequency: 5m
description: |
A Tier Model object has been modified to Enable, Disable, or Unlock of a Tier Level Object.
id: 1da0cf44-c927-4b6f-9b43-91871b2391b3
triggerThreshold: 0
queryPeriod: 5m
version: 1.0.0
kind: Scheduled
customDetails:
AttributeValue: AttributeValue
ObjectName: ObjectName
Domain: Domain
EventData: EventData
ActivityType: ActivityType
Account: Account
ObjectClass: ObjectClass
ObjectTier: ObjectTier
EventID: EventID
Channel: Channel
Computer: Computer
status: Available
eventGroupingSettings:
aggregationKind: AlertPerResult
severity: High
requiredDataConnectors:
- connectorId: SecurityEvents
dataTypes:
- SecurityEvent
- connectorId: WindowsSecurityEvents
dataTypes:
- SecurityEvent
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM004_OBJECTEnabledDisabledUnlockedOrPasswordResetOfATierLevelObje.yaml
alertDetailsOverride:
alertDescriptionFormat: '{{ObjectTier}} {{ObjectName}} was {{AttributeValue}}.'
alertDisplayNameFormat: (TM004.1) A {{ObjectTier}} {{ObjectClass}} was {{AttributeValue}}
relevantTechniques:
- T1078.002
tactics:
- Persistence
entityMappings:
- fieldMappings:
- identifier: FullName
columnName: ObjectName
entityType: Account
- fieldMappings:
- identifier: HostName
columnName: Computer
entityType: Host
- fieldMappings:
- identifier: FullName
columnName: Account
entityType: Account
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/1da0cf44-c927-4b6f-9b43-91871b2391b3')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/1da0cf44-c927-4b6f-9b43-91871b2391b3')]",
"properties": {
"alertDetailsOverride": {
"alertDescriptionFormat": "{{ObjectTier}} {{ObjectName}} was {{AttributeValue}}.",
"alertDisplayNameFormat": "(TM004.1) A {{ObjectTier}} {{ObjectClass}} was {{AttributeValue}}"
},
"alertRuleTemplateName": "1da0cf44-c927-4b6f-9b43-91871b2391b3",
"customDetails": {
"Account": "Account",
"ActivityType": "ActivityType",
"AttributeValue": "AttributeValue",
"Channel": "Channel",
"Computer": "Computer",
"Domain": "Domain",
"EventData": "EventData",
"EventID": "EventID",
"ObjectClass": "ObjectClass",
"ObjectName": "ObjectName",
"ObjectTier": "ObjectTier"
},
"description": "A Tier Model object has been modified to Enable, Disable, or Unlock of a Tier Level Object.\n",
"displayName": "PROD (TM004.1) - OBJECT - Enabled, Disabled, Unlocked, or Password Reset of a Tier Level Object",
"enabled": true,
"entityMappings": [
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "ObjectName",
"identifier": "FullName"
}
]
},
{
"entityType": "Host",
"fieldMappings": [
{
"columnName": "Computer",
"identifier": "HostName"
}
]
},
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "Account",
"identifier": "FullName"
}
]
}
],
"eventGroupingSettings": {
"aggregationKind": "AlertPerResult"
},
"incidentConfiguration": {
"createIncident": true,
"groupingConfiguration": {
"enabled": false,
"lookbackDuration": "PT5H",
"matchingMethod": "AllEntities",
"reopenClosedIncident": false
}
},
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM004_OBJECTEnabledDisabledUnlockedOrPasswordResetOfATierLevelObje.yaml",
"query": "SecurityEvent \n| where EventID == 5136 \n and (EventData matches regex @\"(?i)OU=Domain Controllers\"\n or EventData matches regex @\"(?i)OU=Tier 0 Accounts\" \n or EventData matches regex @\"(?i)OU=Tier 1 Accounts\" \n or EventData matches regex @\"(?i)OU=Tier 2 Accounts\"\n or EventData matches regex @\"(?i)OU=Tier 0 Service Accounts\" \n or EventData matches regex @\"(?i)OU=Tier 1 Service Accounts\" \n or EventData matches regex @\"(?i)OU=Tier 2 Service Accounts\"\n or EventData matches regex @\"(?i)OU=Tier 0 PAW\"\n or EventData matches regex @\"(?i)OU=Tier 1 PAW\"\n or EventData matches regex @\"(?i)OU=Tier 2 PAW\"\n or EventData matches regex @\"(?i)OU=Tier 0 Member Servers\"\n or EventData matches regex @\"(?i)OU=Tier 1 Member Servers\")\n and (EventData has 'AttributeValue\">512'\n or EventData has 'AttributeLDAPDisplayName\">userAccountControl'\n or EventData has 'AttributeLDAPDisplayName\">lockoutTime'\n or EventData has 'AttributeLDAPDisplayName\">pwdLastSet')\n and (EventData has 'AttributeValue\">512'\n or EventData has 'AttributeValue\">514'\n or EventData has 'AttributeValue\">0'\n or EventData has 'AttributeValue\">4130'\n or EventData has 'AttributeValue\">4128')\n and EventData has 'OperationType\">%%14674'\n| extend ObjectName_e = extract(\"<Data Name=\\\"ObjectDN\\\">([^<]+)</Data>\", 1, EventData)\n| extend ObjectName = extract(\"(?i)CN=([^,]+)\", 1, ObjectName_e)\n| extend ObjectTier_e = extract(\"<Data Name=\\\"ObjectDN\\\">([^<]+)</Data>\", 1, EventData)\n| extend ObjectTier = extract(\"(?i)OU=(Tier [^ ]+)\", 1, ObjectTier_e)\n| extend ObjectTier = iff(isempty(ObjectTier), \n iff(EventData matches regex @\"(?i)OU=Domain Controllers\", \"Tier 0\", \"Outside Tier Model\"), \n ObjectTier)\n| extend AttributeLDAP = extract(\"<Data Name=\\\"AttributeLDAPDisplayName\\\">([^<]+)</Data>\", 1, EventData)\n| extend AttributeValue = extract(\"<Data Name=\\\"AttributeValue\\\">([^<]+)</Data>\", 1, EventData)\n| extend AttributeValue = iff(EventData has 'AttributeValue\">512' or EventData has 'AttributeValue\">4128', \"Enabled\", tostring(AttributeValue))\n| extend AttributeValue = iff(EventData has 'AttributeValue\">514' or EventData has 'AttributeValue\">4130', \"Disabled\", tostring(AttributeValue))\n| extend AttributeValue = iff(EventData has 'AttributeValue\">0' and AttributeLDAP == \"pwdLastSet\", \"Password Reset\", tostring(AttributeValue))\n| extend AttributeValue = iff(EventData has 'AttributeValue\">0' and AttributeLDAP == \"lockoutTime\", \"Account Unlocked\", tostring(AttributeValue))\n| extend ObjectClass = extract(\"<Data Name=\\\"ObjectClass\\\">([^<]+)</Data>\", 1, EventData)\n| extend ActivityType = extract(\"([a-zA-Z]+)\\\\.$\", 1, Activity)\n| extend Domain = extract(\"([^.]+\\\\.[^.]+)$\", 1, Computer)\n| project TimeGenerated\n , ObjectName\n , ObjectTier\n , ObjectClass\n , AttributeValue \n , ActivityType\n , Account\n , Domain\n , Computer\n , Channel\n , EventID\n , EventData\n",
"queryFrequency": "PT5M",
"queryPeriod": "PT5M",
"severity": "High",
"status": "Available",
"subTechniques": [
"T1078.002"
],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"Persistence"
],
"techniques": [
"T1078"
],
"templateVersion": "1.0.0",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}