Analytic rule catalog
PROD TM0071 - OU - Created or Deleted at Tier Level
Back
| Id | 4e027b5f-fc4a-4de6-be24-3eb9324e2fc8 |
| Rulename | PROD (TM007.1) - OU - Created or Deleted at Tier Level |
| Description | Creation or Deletion of an OU within the Tier Model |
| Severity | High |
| Tactics | DefenseEvasion |
| Techniques | T1222.001 |
| Required data connectors | SecurityEvents WindowsSecurityEvents |
| Kind | Scheduled |
| Query frequency | 5m |
| Query period | 5m |
| Trigger threshold | 0 |
| Trigger operator | gt |
| Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM007_OUCreatedOrDeletedAtTierLevel.yaml |
| Version | 1.0.0 |
| Arm template | 4e027b5f-fc4a-4de6-be24-3eb9324e2fc8.json |
SecurityEvent
| where (EventID == 5137
or EventID == 5141)
and (EventData matches regex @"(?i)OU=Domain Controllers"
or EventData matches regex @"(?i)OU=Tier 0 Member Servers"
or EventData matches regex @"(?i)OU=Tier 1 Member Servers"
or EventData matches regex @"(?i)OU=Tier 2 End-User Accounts"
or EventData matches regex @"(?i)OU=Tier 2 End-User Devices"
or EventData matches regex @"(?i)OU=Tier 2 End-User Groups"
or EventData matches regex @"(?i)OU=Tier Model Administration"
or EventData matches regex @"(?i)OU=Tier Model Computer Quarantine")
and EventData has '"ObjectClass">organizationalUnit'
| extend ObjectName = extract("(?i)<Data Name=\"ObjectDN\">(((?i)OU=[^,]+,?)+),(?i)DC=", 1, EventData)
| extend ObjectTier = case(
ObjectName has "Tier 0", "Tier 0",
ObjectName has "Tier 1", "Tier 1",
ObjectName has "Tier 2", "Tier 2",
ObjectName has "Tier Model Administration", "Tier 0",
ObjectName has "Tier Model Computer Quarantine", "Tier 0",
ObjectName has "Domain Controllers", "Tier 0",
"Unknown")
| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| extend SubjectUserName = extract("<Data Name=\"SubjectUserName\">([^<]+)</Data>", 1, EventData)
| extend SubjectDomainName = extract("<Data Name=\"SubjectDomainName\">([^<]+)</Data>", 1, EventData)
| extend Account = strcat(SubjectDomainName, "\\", SubjectUserName)
| project TimeGenerated
, ObjectName
, ObjectTier
, ObjectClass
, ActivityType
, Account
, Domain
, Computer
, Channel
, EventID
, EventData
version: 1.0.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM007_OUCreatedOrDeletedAtTierLevel.yaml
triggerThreshold: 0
requiredDataConnectors:
- dataTypes:
- SecurityEvent
connectorId: SecurityEvents
- dataTypes:
- SecurityEvent
connectorId: WindowsSecurityEvents
tactics:
- DefenseEvasion
relevantTechniques:
- T1222.001
eventGroupingSettings:
aggregationKind: AlertPerResult
incidentConfiguration:
groupingConfiguration:
matchingMethod: AllEntities
lookbackDuration: PT5H
reopenClosedIncident: false
enabled: false
createIncident: true
alertDetailsOverride:
alertDescriptionFormat: A OU was deleted or created within the Tier Model.
alertDisplayNameFormat: (TM007.1) A {{ObjectTier}} OU was {{ActivityType}}
entityMappings:
- fieldMappings:
- identifier: FullName
columnName: ObjectName
entityType: Account
- fieldMappings:
- identifier: HostName
columnName: Computer
entityType: Host
- fieldMappings:
- identifier: FullName
columnName: Account
entityType: Account
description: |
Creation or Deletion of an OU within the Tier Model
triggerOperator: gt
kind: Scheduled
status: Available
queryFrequency: 5m
id: 4e027b5f-fc4a-4de6-be24-3eb9324e2fc8
name: PROD (TM007.1) - OU - Created or Deleted at Tier Level
severity: High
query: |
SecurityEvent
| where (EventID == 5137
or EventID == 5141)
and (EventData matches regex @"(?i)OU=Domain Controllers"
or EventData matches regex @"(?i)OU=Tier 0 Member Servers"
or EventData matches regex @"(?i)OU=Tier 1 Member Servers"
or EventData matches regex @"(?i)OU=Tier 2 End-User Accounts"
or EventData matches regex @"(?i)OU=Tier 2 End-User Devices"
or EventData matches regex @"(?i)OU=Tier 2 End-User Groups"
or EventData matches regex @"(?i)OU=Tier Model Administration"
or EventData matches regex @"(?i)OU=Tier Model Computer Quarantine")
and EventData has '"ObjectClass">organizationalUnit'
| extend ObjectName = extract("(?i)<Data Name=\"ObjectDN\">(((?i)OU=[^,]+,?)+),(?i)DC=", 1, EventData)
| extend ObjectTier = case(
ObjectName has "Tier 0", "Tier 0",
ObjectName has "Tier 1", "Tier 1",
ObjectName has "Tier 2", "Tier 2",
ObjectName has "Tier Model Administration", "Tier 0",
ObjectName has "Tier Model Computer Quarantine", "Tier 0",
ObjectName has "Domain Controllers", "Tier 0",
"Unknown")
| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| extend SubjectUserName = extract("<Data Name=\"SubjectUserName\">([^<]+)</Data>", 1, EventData)
| extend SubjectDomainName = extract("<Data Name=\"SubjectDomainName\">([^<]+)</Data>", 1, EventData)
| extend Account = strcat(SubjectDomainName, "\\", SubjectUserName)
| project TimeGenerated
, ObjectName
, ObjectTier
, ObjectClass
, ActivityType
, Account
, Domain
, Computer
, Channel
, EventID
, EventData
queryPeriod: 5m
customDetails:
Computer: Computer
ObjectName: ObjectName
EventID: EventID
ObjectClass: ObjectClass
ActivityType: ActivityType
Account: Account
EventData: EventData
Channel: Channel
Domain: Domain
ObjectTier: ObjectTier
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/4e027b5f-fc4a-4de6-be24-3eb9324e2fc8')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/4e027b5f-fc4a-4de6-be24-3eb9324e2fc8')]",
"properties": {
"alertDetailsOverride": {
"alertDescriptionFormat": "A OU was deleted or created within the Tier Model.",
"alertDisplayNameFormat": "(TM007.1) A {{ObjectTier}} OU was {{ActivityType}}"
},
"alertRuleTemplateName": "4e027b5f-fc4a-4de6-be24-3eb9324e2fc8",
"customDetails": {
"Account": "Account",
"ActivityType": "ActivityType",
"Channel": "Channel",
"Computer": "Computer",
"Domain": "Domain",
"EventData": "EventData",
"EventID": "EventID",
"ObjectClass": "ObjectClass",
"ObjectName": "ObjectName",
"ObjectTier": "ObjectTier"
},
"description": "Creation or Deletion of an OU within the Tier Model\n",
"displayName": "PROD (TM007.1) - OU - Created or Deleted at Tier Level",
"enabled": true,
"entityMappings": [
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "ObjectName",
"identifier": "FullName"
}
]
},
{
"entityType": "Host",
"fieldMappings": [
{
"columnName": "Computer",
"identifier": "HostName"
}
]
},
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "Account",
"identifier": "FullName"
}
]
}
],
"eventGroupingSettings": {
"aggregationKind": "AlertPerResult"
},
"incidentConfiguration": {
"createIncident": true,
"groupingConfiguration": {
"enabled": false,
"lookbackDuration": "PT5H",
"matchingMethod": "AllEntities",
"reopenClosedIncident": false
}
},
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM007_OUCreatedOrDeletedAtTierLevel.yaml",
"query": "SecurityEvent \n| where (EventID == 5137\n or EventID == 5141)\n and (EventData matches regex @\"(?i)OU=Domain Controllers\"\n or EventData matches regex @\"(?i)OU=Tier 0 Member Servers\"\n or EventData matches regex @\"(?i)OU=Tier 1 Member Servers\"\n or EventData matches regex @\"(?i)OU=Tier 2 End-User Accounts\"\n or EventData matches regex @\"(?i)OU=Tier 2 End-User Devices\"\n or EventData matches regex @\"(?i)OU=Tier 2 End-User Groups\"\n or EventData matches regex @\"(?i)OU=Tier Model Administration\"\n or EventData matches regex @\"(?i)OU=Tier Model Computer Quarantine\")\n and EventData has '\"ObjectClass\">organizationalUnit'\n| extend ObjectName = extract(\"(?i)<Data Name=\\\"ObjectDN\\\">(((?i)OU=[^,]+,?)+),(?i)DC=\", 1, EventData)\n| extend ObjectTier = case(\n ObjectName has \"Tier 0\", \"Tier 0\",\n ObjectName has \"Tier 1\", \"Tier 1\",\n ObjectName has \"Tier 2\", \"Tier 2\",\n ObjectName has \"Tier Model Administration\", \"Tier 0\",\n ObjectName has \"Tier Model Computer Quarantine\", \"Tier 0\",\n ObjectName has \"Domain Controllers\", \"Tier 0\",\n \"Unknown\")\n| extend ActivityType = extract(\"([a-zA-Z]+)\\\\.$\", 1, Activity)\n| extend ObjectClass = extract(\"<Data Name=\\\"ObjectClass\\\">([^<]+)</Data>\", 1, EventData)\n| extend Domain = extract(\"([^.]+\\\\.[^.]+)$\", 1, Computer)\n| extend SubjectUserName = extract(\"<Data Name=\\\"SubjectUserName\\\">([^<]+)</Data>\", 1, EventData)\n| extend SubjectDomainName = extract(\"<Data Name=\\\"SubjectDomainName\\\">([^<]+)</Data>\", 1, EventData)\n| extend Account = strcat(SubjectDomainName, \"\\\\\", SubjectUserName)\n| project TimeGenerated\n , ObjectName\n , ObjectTier\n , ObjectClass\n , ActivityType\n , Account\n , Domain\n , Computer\n , Channel\n , EventID\n , EventData\n",
"queryFrequency": "PT5M",
"queryPeriod": "PT5M",
"severity": "High",
"status": "Available",
"subTechniques": [
"T1222.001"
],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"DefenseEvasion"
],
"techniques": [
"T1222"
],
"templateVersion": "1.0.0",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}