Analytic rule catalog
PROD TM0071 - OU - Created or Deleted at Tier Level
Back
| Id | 4e027b5f-fc4a-4de6-be24-3eb9324e2fc8 |
| Rulename | PROD (TM007.1) - OU - Created or Deleted at Tier Level |
| Description | Creation or Deletion of an OU within the Tier Model |
| Severity | High |
| Tactics | DefenseEvasion |
| Techniques | T1222.001 |
| Required data connectors | SecurityEvents WindowsSecurityEvents |
| Kind | Scheduled |
| Query frequency | 5m |
| Query period | 5m |
| Trigger threshold | 0 |
| Trigger operator | gt |
| Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM007_OUCreatedOrDeletedAtTierLevel.yaml |
| Version | 1.0.0 |
| Arm template | 4e027b5f-fc4a-4de6-be24-3eb9324e2fc8.json |
SecurityEvent
| where (EventID == 5137
or EventID == 5141)
and (EventData matches regex @"(?i)OU=Domain Controllers"
or EventData matches regex @"(?i)OU=Tier 0 Member Servers"
or EventData matches regex @"(?i)OU=Tier 1 Member Servers"
or EventData matches regex @"(?i)OU=Tier 2 End-User Accounts"
or EventData matches regex @"(?i)OU=Tier 2 End-User Devices"
or EventData matches regex @"(?i)OU=Tier 2 End-User Groups"
or EventData matches regex @"(?i)OU=Tier Model Administration"
or EventData matches regex @"(?i)OU=Tier Model Computer Quarantine")
and EventData has '"ObjectClass">organizationalUnit'
| extend ObjectName = extract("(?i)<Data Name=\"ObjectDN\">(((?i)OU=[^,]+,?)+),(?i)DC=", 1, EventData)
| extend ObjectTier = case(
ObjectName has "Tier 0", "Tier 0",
ObjectName has "Tier 1", "Tier 1",
ObjectName has "Tier 2", "Tier 2",
ObjectName has "Tier Model Administration", "Tier 0",
ObjectName has "Tier Model Computer Quarantine", "Tier 0",
ObjectName has "Domain Controllers", "Tier 0",
"Unknown")
| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| extend SubjectUserName = extract("<Data Name=\"SubjectUserName\">([^<]+)</Data>", 1, EventData)
| extend SubjectDomainName = extract("<Data Name=\"SubjectDomainName\">([^<]+)</Data>", 1, EventData)
| extend Account = strcat(SubjectDomainName, "\\", SubjectUserName)
| project TimeGenerated
, ObjectName
, ObjectTier
, ObjectClass
, ActivityType
, Account
, Domain
, Computer
, Channel
, EventID
, EventData
incidentConfiguration:
groupingConfiguration:
lookbackDuration: PT5H
reopenClosedIncident: false
matchingMethod: AllEntities
enabled: false
createIncident: true
name: PROD (TM007.1) - OU - Created or Deleted at Tier Level
triggerOperator: gt
query: |
SecurityEvent
| where (EventID == 5137
or EventID == 5141)
and (EventData matches regex @"(?i)OU=Domain Controllers"
or EventData matches regex @"(?i)OU=Tier 0 Member Servers"
or EventData matches regex @"(?i)OU=Tier 1 Member Servers"
or EventData matches regex @"(?i)OU=Tier 2 End-User Accounts"
or EventData matches regex @"(?i)OU=Tier 2 End-User Devices"
or EventData matches regex @"(?i)OU=Tier 2 End-User Groups"
or EventData matches regex @"(?i)OU=Tier Model Administration"
or EventData matches regex @"(?i)OU=Tier Model Computer Quarantine")
and EventData has '"ObjectClass">organizationalUnit'
| extend ObjectName = extract("(?i)<Data Name=\"ObjectDN\">(((?i)OU=[^,]+,?)+),(?i)DC=", 1, EventData)
| extend ObjectTier = case(
ObjectName has "Tier 0", "Tier 0",
ObjectName has "Tier 1", "Tier 1",
ObjectName has "Tier 2", "Tier 2",
ObjectName has "Tier Model Administration", "Tier 0",
ObjectName has "Tier Model Computer Quarantine", "Tier 0",
ObjectName has "Domain Controllers", "Tier 0",
"Unknown")
| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| extend SubjectUserName = extract("<Data Name=\"SubjectUserName\">([^<]+)</Data>", 1, EventData)
| extend SubjectDomainName = extract("<Data Name=\"SubjectDomainName\">([^<]+)</Data>", 1, EventData)
| extend Account = strcat(SubjectDomainName, "\\", SubjectUserName)
| project TimeGenerated
, ObjectName
, ObjectTier
, ObjectClass
, ActivityType
, Account
, Domain
, Computer
, Channel
, EventID
, EventData
queryFrequency: 5m
description: |
Creation or Deletion of an OU within the Tier Model
id: 4e027b5f-fc4a-4de6-be24-3eb9324e2fc8
triggerThreshold: 0
queryPeriod: 5m
version: 1.0.0
kind: Scheduled
customDetails:
Account: Account
ObjectName: ObjectName
Domain: Domain
EventData: EventData
ActivityType: ActivityType
ObjectClass: ObjectClass
ObjectTier: ObjectTier
EventID: EventID
Channel: Channel
Computer: Computer
status: Available
eventGroupingSettings:
aggregationKind: AlertPerResult
severity: High
requiredDataConnectors:
- connectorId: SecurityEvents
dataTypes:
- SecurityEvent
- connectorId: WindowsSecurityEvents
dataTypes:
- SecurityEvent
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM007_OUCreatedOrDeletedAtTierLevel.yaml
alertDetailsOverride:
alertDescriptionFormat: A OU was deleted or created within the Tier Model.
alertDisplayNameFormat: (TM007.1) A {{ObjectTier}} OU was {{ActivityType}}
relevantTechniques:
- T1222.001
tactics:
- DefenseEvasion
entityMappings:
- fieldMappings:
- identifier: FullName
columnName: ObjectName
entityType: Account
- fieldMappings:
- identifier: HostName
columnName: Computer
entityType: Host
- fieldMappings:
- identifier: FullName
columnName: Account
entityType: Account
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/4e027b5f-fc4a-4de6-be24-3eb9324e2fc8')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/4e027b5f-fc4a-4de6-be24-3eb9324e2fc8')]",
"properties": {
"alertDetailsOverride": {
"alertDescriptionFormat": "A OU was deleted or created within the Tier Model.",
"alertDisplayNameFormat": "(TM007.1) A {{ObjectTier}} OU was {{ActivityType}}"
},
"alertRuleTemplateName": "4e027b5f-fc4a-4de6-be24-3eb9324e2fc8",
"customDetails": {
"Account": "Account",
"ActivityType": "ActivityType",
"Channel": "Channel",
"Computer": "Computer",
"Domain": "Domain",
"EventData": "EventData",
"EventID": "EventID",
"ObjectClass": "ObjectClass",
"ObjectName": "ObjectName",
"ObjectTier": "ObjectTier"
},
"description": "Creation or Deletion of an OU within the Tier Model\n",
"displayName": "PROD (TM007.1) - OU - Created or Deleted at Tier Level",
"enabled": true,
"entityMappings": [
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "ObjectName",
"identifier": "FullName"
}
]
},
{
"entityType": "Host",
"fieldMappings": [
{
"columnName": "Computer",
"identifier": "HostName"
}
]
},
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "Account",
"identifier": "FullName"
}
]
}
],
"eventGroupingSettings": {
"aggregationKind": "AlertPerResult"
},
"incidentConfiguration": {
"createIncident": true,
"groupingConfiguration": {
"enabled": false,
"lookbackDuration": "PT5H",
"matchingMethod": "AllEntities",
"reopenClosedIncident": false
}
},
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM007_OUCreatedOrDeletedAtTierLevel.yaml",
"query": "SecurityEvent \n| where (EventID == 5137\n or EventID == 5141)\n and (EventData matches regex @\"(?i)OU=Domain Controllers\"\n or EventData matches regex @\"(?i)OU=Tier 0 Member Servers\"\n or EventData matches regex @\"(?i)OU=Tier 1 Member Servers\"\n or EventData matches regex @\"(?i)OU=Tier 2 End-User Accounts\"\n or EventData matches regex @\"(?i)OU=Tier 2 End-User Devices\"\n or EventData matches regex @\"(?i)OU=Tier 2 End-User Groups\"\n or EventData matches regex @\"(?i)OU=Tier Model Administration\"\n or EventData matches regex @\"(?i)OU=Tier Model Computer Quarantine\")\n and EventData has '\"ObjectClass\">organizationalUnit'\n| extend ObjectName = extract(\"(?i)<Data Name=\\\"ObjectDN\\\">(((?i)OU=[^,]+,?)+),(?i)DC=\", 1, EventData)\n| extend ObjectTier = case(\n ObjectName has \"Tier 0\", \"Tier 0\",\n ObjectName has \"Tier 1\", \"Tier 1\",\n ObjectName has \"Tier 2\", \"Tier 2\",\n ObjectName has \"Tier Model Administration\", \"Tier 0\",\n ObjectName has \"Tier Model Computer Quarantine\", \"Tier 0\",\n ObjectName has \"Domain Controllers\", \"Tier 0\",\n \"Unknown\")\n| extend ActivityType = extract(\"([a-zA-Z]+)\\\\.$\", 1, Activity)\n| extend ObjectClass = extract(\"<Data Name=\\\"ObjectClass\\\">([^<]+)</Data>\", 1, EventData)\n| extend Domain = extract(\"([^.]+\\\\.[^.]+)$\", 1, Computer)\n| extend SubjectUserName = extract(\"<Data Name=\\\"SubjectUserName\\\">([^<]+)</Data>\", 1, EventData)\n| extend SubjectDomainName = extract(\"<Data Name=\\\"SubjectDomainName\\\">([^<]+)</Data>\", 1, EventData)\n| extend Account = strcat(SubjectDomainName, \"\\\\\", SubjectUserName)\n| project TimeGenerated\n , ObjectName\n , ObjectTier\n , ObjectClass\n , ActivityType\n , Account\n , Domain\n , Computer\n , Channel\n , EventID\n , EventData\n",
"queryFrequency": "PT5M",
"queryPeriod": "PT5M",
"severity": "High",
"status": "Available",
"subTechniques": [
"T1222.001"
],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"DefenseEvasion"
],
"techniques": [
"T1222"
],
"templateVersion": "1.0.0",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}