AdminSDHolder Modifications
Id | 52aec824-96c1-4a03-8e44-bb70532e6cea |
Rulename | AdminSDHolder Modifications |
Description | This query detects modification in the AdminSDHolder in the Active Directory which could indicate an attempt for persistence. AdminSDHolder Modification is a persistence technique in which an attacker abuses the SDProp process in Active Directory to establish a persistent backdoor to Active Directory. This query searches for the event id 5136 where the Object DN is AdminSDHolder. Ref: https://attack.stealthbits.com/adminsdholder-modification-ad-persistence |
Severity | High |
Tactics | Persistence |
Techniques | T1078 |
Required data connectors | SecurityEvents |
Kind | Scheduled |
Query frequency | 1h |
Query period | 1h |
Trigger threshold | 0 |
Trigger operator | gt |
Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Detections/SecurityEvent/AdminSDHolder_Modifications.yaml |
Version | 1.0.2 |
Arm template | 52aec824-96c1-4a03-8e44-bb70532e6cea.json |
SecurityEvent
| where EventID == 5136 and EventData contains "<Data Name=\"ObjectDN\">CN=AdminSDHolder,CN=System"
| parse EventData with * 'ObjectDN">' ObjectDN "<" *
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by Computer, SubjectAccount, SubjectUserSid, SubjectLogonId, ObjectDN
triggerOperator: gt
version: 1.0.2
query: |
SecurityEvent
| where EventID == 5136 and EventData contains "<Data Name=\"ObjectDN\">CN=AdminSDHolder,CN=System"
| parse EventData with * 'ObjectDN">' ObjectDN "<" *
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by Computer, SubjectAccount, SubjectUserSid, SubjectLogonId, ObjectDN
entityMappings:
- entityType: Account
fieldMappings:
- columnName: SubjectAccount
identifier: FullName
- entityType: Host
fieldMappings:
- columnName: Computer
identifier: FullName
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/SecurityEvent/AdminSDHolder_Modifications.yaml
queryFrequency: 1h
requiredDataConnectors:
- connectorId: SecurityEvents
dataTypes:
- SecurityEvent
metadata:
source:
kind: Community
author:
name: Vasileios Paschalidis
categories:
domains:
- Security - Others
support:
tier: Community
name: AdminSDHolder Modifications
queryPeriod: 1h
severity: High
kind: Scheduled
tactics:
- Persistence
id: 52aec824-96c1-4a03-8e44-bb70532e6cea
description: |
'This query detects modification in the AdminSDHolder in the Active Directory which could indicate an attempt for persistence.
AdminSDHolder Modification is a persistence technique in which an attacker abuses the SDProp process in Active Directory to establish a persistent backdoor to Active Directory.
This query searches for the event id 5136 where the Object DN is AdminSDHolder.
Ref: https://attack.stealthbits.com/adminsdholder-modification-ad-persistence'
relevantTechniques:
- T1078
triggerThreshold: 0
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/52aec824-96c1-4a03-8e44-bb70532e6cea')]",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/52aec824-96c1-4a03-8e44-bb70532e6cea')]",
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
"kind": "Scheduled",
"apiVersion": "2022-11-01-preview",
"properties": {
"displayName": "AdminSDHolder Modifications",
"description": "'This query detects modification in the AdminSDHolder in the Active Directory which could indicate an attempt for persistence. \nAdminSDHolder Modification is a persistence technique in which an attacker abuses the SDProp process in Active Directory to establish a persistent backdoor to Active Directory.\nThis query searches for the event id 5136 where the Object DN is AdminSDHolder.\nRef: https://attack.stealthbits.com/adminsdholder-modification-ad-persistence'\n",
"severity": "High",
"enabled": true,
"query": "SecurityEvent\n| where EventID == 5136 and EventData contains \"<Data Name=\\\"ObjectDN\\\">CN=AdminSDHolder,CN=System\"\n| parse EventData with * 'ObjectDN\">' ObjectDN \"<\" *\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by Computer, SubjectAccount, SubjectUserSid, SubjectLogonId, ObjectDN\n",
"queryFrequency": "PT1H",
"queryPeriod": "PT1H",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0,
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"Persistence"
],
"techniques": [
"T1078"
],
"alertRuleTemplateName": "52aec824-96c1-4a03-8e44-bb70532e6cea",
"customDetails": null,
"entityMappings": [
{
"fieldMappings": [
{
"columnName": "SubjectAccount",
"identifier": "FullName"
}
],
"entityType": "Account"
},
{
"fieldMappings": [
{
"columnName": "Computer",
"identifier": "FullName"
}
],
"entityType": "Host"
}
],
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Detections/SecurityEvent/AdminSDHolder_Modifications.yaml",
"templateVersion": "1.0.2"
}
}
]
}