Analytic rule catalog
PROD TM0141 - GPO - Linked Unlinked or Enforced at the AD Site Level
Back
| Id | 38f2f6f4-2869-401c-8341-e3a5c11018a5 |
| Rulename | PROD (TM014.1) - GPO - Linked, Unlinked, or Enforced at the AD Site Level |
| Description | Monitoring AD Site GPOs being Linked, Unlinked, or Enforced. |
| Severity | High |
| Tactics | DefenseEvasion |
| Techniques | T1484.001 |
| Required data connectors | SecurityEvents WindowsSecurityEvents |
| Kind | Scheduled |
| Query frequency | 5m |
| Query period | 5m |
| Trigger threshold | 0 |
| Trigger operator | gt |
| Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM014_GPOLinkedUnlinkedOrEnforcedAtTheADSiteLevel.yaml |
| Version | 1.0.0 |
| Arm template | 38f2f6f4-2869-401c-8341-e3a5c11018a5.json |
SecurityEvent
| where EventID == 5136
and EventData matches regex @"(?i)CN=Sites"
and Activity has "modified"
and EventData has '"ObjectClass">site'
and EventData has '<Data Name="AttributeLDAPDisplayName">gPLink</Data>'
and (EventData has ';0]'
or EventData has ';1]'
or EventData has ';2]')
and EventData has '"OperationType">%%14674'
| extend ObjectName = extract("<Data Name=\"ObjectDN\">((?i)CN=[^,]+(?:,(?i)CN=[^,]+)*),DC=", 1, EventData)
| extend AttributeLDAP = extract("<Data Name=\"AttributeLDAPDisplayName\">([^<]+)</Data>", 1, EventData)
| extend AttributeValue = extract("\\[([^\\]]+)\\]", 1, EventData)
| extend LastThreeChars = substring(AttributeValue, strlen(AttributeValue) - 2, 3)
| extend AttributeValueDescription = case(
LastThreeChars == ";0", "Linked",
LastThreeChars == ";1", "Unlinked",
LastThreeChars == ";2", "Enforced",
"Unknown")
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| project TimeGenerated
, ObjectName
, ObjectClass
, ActivityType = AttributeValueDescription
, AttributeLDAP
, Account
, Domain
, Computer
, Channel
, EventID
, EventData
incidentConfiguration:
groupingConfiguration:
lookbackDuration: PT5H
reopenClosedIncident: false
matchingMethod: AllEntities
enabled: false
createIncident: true
name: PROD (TM014.1) - GPO - Linked, Unlinked, or Enforced at the AD Site Level
triggerOperator: gt
query: |
SecurityEvent
| where EventID == 5136
and EventData matches regex @"(?i)CN=Sites"
and Activity has "modified"
and EventData has '"ObjectClass">site'
and EventData has '<Data Name="AttributeLDAPDisplayName">gPLink</Data>'
and (EventData has ';0]'
or EventData has ';1]'
or EventData has ';2]')
and EventData has '"OperationType">%%14674'
| extend ObjectName = extract("<Data Name=\"ObjectDN\">((?i)CN=[^,]+(?:,(?i)CN=[^,]+)*),DC=", 1, EventData)
| extend AttributeLDAP = extract("<Data Name=\"AttributeLDAPDisplayName\">([^<]+)</Data>", 1, EventData)
| extend AttributeValue = extract("\\[([^\\]]+)\\]", 1, EventData)
| extend LastThreeChars = substring(AttributeValue, strlen(AttributeValue) - 2, 3)
| extend AttributeValueDescription = case(
LastThreeChars == ";0", "Linked",
LastThreeChars == ";1", "Unlinked",
LastThreeChars == ";2", "Enforced",
"Unknown")
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| project TimeGenerated
, ObjectName
, ObjectClass
, ActivityType = AttributeValueDescription
, AttributeLDAP
, Account
, Domain
, Computer
, Channel
, EventID
, EventData
queryFrequency: 5m
description: |
Monitoring AD Site GPOs being Linked, Unlinked, or Enforced.
id: 38f2f6f4-2869-401c-8341-e3a5c11018a5
triggerThreshold: 0
queryPeriod: 5m
version: 1.0.0
kind: Scheduled
customDetails:
Account: Account
ObjectName: ObjectName
Domain: Domain
Channel: Channel
ActivityType: ActivityType
ObjectClass: ObjectClass
EventData: EventData
EventID: EventID
AttributeLDAP: AttributeLDAP
Computer: Computer
status: Available
eventGroupingSettings:
aggregationKind: AlertPerResult
severity: High
requiredDataConnectors:
- connectorId: SecurityEvents
dataTypes:
- SecurityEvent
- connectorId: WindowsSecurityEvents
dataTypes:
- SecurityEvent
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM014_GPOLinkedUnlinkedOrEnforcedAtTheADSiteLevel.yaml
alertDetailsOverride:
alertDescriptionFormat: Site Level GPOs can overwrite Tier Model GPOs.
alertDisplayNameFormat: (TM014.1) A GPO was {{ActivityType}} at the Active Directory Site Level
relevantTechniques:
- T1484.001
tactics:
- DefenseEvasion
entityMappings:
- fieldMappings:
- identifier: FullName
columnName: ObjectName
entityType: Account
- fieldMappings:
- identifier: HostName
columnName: Computer
entityType: Host
- fieldMappings:
- identifier: FullName
columnName: Account
entityType: Account
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/38f2f6f4-2869-401c-8341-e3a5c11018a5')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/38f2f6f4-2869-401c-8341-e3a5c11018a5')]",
"properties": {
"alertDetailsOverride": {
"alertDescriptionFormat": "Site Level GPOs can overwrite Tier Model GPOs.",
"alertDisplayNameFormat": "(TM014.1) A GPO was {{ActivityType}} at the Active Directory Site Level"
},
"alertRuleTemplateName": "38f2f6f4-2869-401c-8341-e3a5c11018a5",
"customDetails": {
"Account": "Account",
"ActivityType": "ActivityType",
"AttributeLDAP": "AttributeLDAP",
"Channel": "Channel",
"Computer": "Computer",
"Domain": "Domain",
"EventData": "EventData",
"EventID": "EventID",
"ObjectClass": "ObjectClass",
"ObjectName": "ObjectName"
},
"description": "Monitoring AD Site GPOs being Linked, Unlinked, or Enforced.\n",
"displayName": "PROD (TM014.1) - GPO - Linked, Unlinked, or Enforced at the AD Site Level",
"enabled": true,
"entityMappings": [
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "ObjectName",
"identifier": "FullName"
}
]
},
{
"entityType": "Host",
"fieldMappings": [
{
"columnName": "Computer",
"identifier": "HostName"
}
]
},
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "Account",
"identifier": "FullName"
}
]
}
],
"eventGroupingSettings": {
"aggregationKind": "AlertPerResult"
},
"incidentConfiguration": {
"createIncident": true,
"groupingConfiguration": {
"enabled": false,
"lookbackDuration": "PT5H",
"matchingMethod": "AllEntities",
"reopenClosedIncident": false
}
},
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM014_GPOLinkedUnlinkedOrEnforcedAtTheADSiteLevel.yaml",
"query": "SecurityEvent \n| where EventID == 5136 \n and EventData matches regex @\"(?i)CN=Sites\"\n and Activity has \"modified\" \n and EventData has '\"ObjectClass\">site'\n and EventData has '<Data Name=\"AttributeLDAPDisplayName\">gPLink</Data>' \n and (EventData has ';0]' \n or EventData has ';1]' \n or EventData has ';2]')\n and EventData has '\"OperationType\">%%14674'\n| extend ObjectName = extract(\"<Data Name=\\\"ObjectDN\\\">((?i)CN=[^,]+(?:,(?i)CN=[^,]+)*),DC=\", 1, EventData)\n| extend AttributeLDAP = extract(\"<Data Name=\\\"AttributeLDAPDisplayName\\\">([^<]+)</Data>\", 1, EventData)\n| extend AttributeValue = extract(\"\\\\[([^\\\\]]+)\\\\]\", 1, EventData)\n| extend LastThreeChars = substring(AttributeValue, strlen(AttributeValue) - 2, 3)\n| extend AttributeValueDescription = case(\n LastThreeChars == \";0\", \"Linked\",\n LastThreeChars == \";1\", \"Unlinked\",\n LastThreeChars == \";2\", \"Enforced\",\n \"Unknown\")\n| extend ObjectClass = extract(\"<Data Name=\\\"ObjectClass\\\">([^<]+)</Data>\", 1, EventData)\n| extend Domain = extract(\"([^.]+\\\\.[^.]+)$\", 1, Computer)\n| project TimeGenerated\n , ObjectName\n , ObjectClass\n , ActivityType = AttributeValueDescription\n , AttributeLDAP\n , Account\n , Domain\n , Computer\n , Channel\n , EventID\n , EventData\n",
"queryFrequency": "PT5M",
"queryPeriod": "PT5M",
"severity": "High",
"status": "Available",
"subTechniques": [
"T1484.001"
],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"DefenseEvasion"
],
"techniques": [
"T1484"
],
"templateVersion": "1.0.0",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}