AR Microsoft Sentinel Analytic Rules ONLINE

Analytic rule catalog

PROD TM0171 - GROUP - Tier 0 Added to Allow RODC Password Replication Group

Back
Id634a69b4-0e46-4349-8463-af1c8d191620
RulenamePROD (TM017.1) - GROUP - Tier 0 Added to Allow RODC Password Replication Group
DescriptionAdding a Tier 0 object to the Allow RODC Password Replication Group.
SeverityHigh
TacticsPrivilegeEscalation
TechniquesT1078.002
Required data connectorsSecurityEvents
WindowsSecurityEvents
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM017_GROUPTier0AddedToAllowRODCPasswordReplicationGroup.yaml
Version1.0.0
Arm template634a69b4-0e46-4349-8463-af1c8d191620.json
Deploy To Azure
SecurityEvent 
| where EventID == 5136
    and Activity has "modified"
    and EventData matches regex "(?i)CN=Allowed RODC Password Replication Group,CN=Users"
    and EventData has '"AttributeLDAPDisplayName">member'
    and EventData has 'OperationType">%%14674'
| extend GroupName_e = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
| extend GroupName = extract("(?i)CN=([^,]+)", 1, GroupName_e)
| extend ObjectName_e = extract("<Data Name=\"AttributeValue\">([^<]+)</Data>", 1, EventData)
| extend ObjectName = extract("(?i)CN=([^,]+)", 1, ObjectName_e)
| extend ObjectTier_e = extract("<Data Name=\"AttributeValue\">([^<]+)</Data>", 1, EventData)
| extend ObjectTier = case(
    ObjectName_e has "Tier 0", "Tier 0",
    ObjectName_e has "Tier 1", "Tier 1",
    ObjectName_e has "Tier 2", "Tier 2",
    "Outside Tier Model")
| where ObjectTier == "Tier 0"
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
| extend SubjectUserName = extract("<Data Name=\"SubjectUserName\">([^<]+)</Data>", 1, EventData)
| extend SubjectDomainName = extract("<Data Name=\"SubjectDomainName\">([^<]+)</Data>", 1, EventData)
| extend Account = strcat(SubjectDomainName, "\\", SubjectUserName)
| extend OperationType = iff(EventData has 'OperationType">%%14674', "Added", tostring(OperationType))
| project TimeGenerated 
        , ObjectName
        , ObjectTier
        , ObjectType = AccountType
        , GroupName
        , ActivityType
        , OperationType
        , Account
        , Domain
        , Computer
        , Channel
        , EventID
        , EventData

relevantTechniques:
- T1078.002
triggerThreshold: 0
id: 634a69b4-0e46-4349-8463-af1c8d191620
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: (TM017.1) A Tier 0 member was added to the Allow RODC Password Replication Group
  alertDescriptionFormat: The following Tier 0 {{ObjectName}} object was added to the Allow RODC Password Replication Group.
queryPeriod: 5m
triggerOperator: gt
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    matchingMethod: AllEntities
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM017_GROUPTier0AddedToAllowRODCPasswordReplicationGroup.yaml
queryFrequency: 5m
requiredDataConnectors:
- dataTypes:
  - SecurityEvent
  connectorId: SecurityEvents
- dataTypes:
  - SecurityEvent
  connectorId: WindowsSecurityEvents
version: 1.0.0
tactics:
- PrivilegeEscalation
query: |
  SecurityEvent 
  | where EventID == 5136
      and Activity has "modified"
      and EventData matches regex "(?i)CN=Allowed RODC Password Replication Group,CN=Users"
      and EventData has '"AttributeLDAPDisplayName">member'
      and EventData has 'OperationType">%%14674'
  | extend GroupName_e = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
  | extend GroupName = extract("(?i)CN=([^,]+)", 1, GroupName_e)
  | extend ObjectName_e = extract("<Data Name=\"AttributeValue\">([^<]+)</Data>", 1, EventData)
  | extend ObjectName = extract("(?i)CN=([^,]+)", 1, ObjectName_e)
  | extend ObjectTier_e = extract("<Data Name=\"AttributeValue\">([^<]+)</Data>", 1, EventData)
  | extend ObjectTier = case(
      ObjectName_e has "Tier 0", "Tier 0",
      ObjectName_e has "Tier 1", "Tier 1",
      ObjectName_e has "Tier 2", "Tier 2",
      "Outside Tier Model")
  | where ObjectTier == "Tier 0"
  | extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
  | extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
  | extend SubjectUserName = extract("<Data Name=\"SubjectUserName\">([^<]+)</Data>", 1, EventData)
  | extend SubjectDomainName = extract("<Data Name=\"SubjectDomainName\">([^<]+)</Data>", 1, EventData)
  | extend Account = strcat(SubjectDomainName, "\\", SubjectUserName)
  | extend OperationType = iff(EventData has 'OperationType">%%14674', "Added", tostring(OperationType))
  | project TimeGenerated 
          , ObjectName
          , ObjectTier
          , ObjectType = AccountType
          , GroupName
          , ActivityType
          , OperationType
          , Account
          , Domain
          , Computer
          , Channel
          , EventID
          , EventData
name: PROD (TM017.1) - GROUP - Tier 0 Added to Allow RODC Password Replication Group
severity: High
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: ObjectName
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: GroupName
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: Computer
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: Account
customDetails:
  Domain: Domain
  ActivityType: ActivityType
  OperationType: OperationType
  ObjectTier: ObjectTier
  Computer: Computer
  ObjectType: ObjectType
  ObjectName: ObjectName
  GroupName: GroupName
  Account: Account
  Channel: Channel
  EventData: EventData
  EventID: EventID
description: |
  Adding a Tier 0 object to the Allow RODC Password Replication Group.
kind: Scheduled

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/634a69b4-0e46-4349-8463-af1c8d191620')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/634a69b4-0e46-4349-8463-af1c8d191620')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "The following Tier 0 {{ObjectName}} object was added to the Allow RODC Password Replication Group.",
          "alertDisplayNameFormat": "(TM017.1) A Tier 0 member was added to the Allow RODC Password Replication Group"
        },
        "alertRuleTemplateName": "634a69b4-0e46-4349-8463-af1c8d191620",
        "customDetails": {
          "Account": "Account",
          "ActivityType": "ActivityType",
          "Channel": "Channel",
          "Computer": "Computer",
          "Domain": "Domain",
          "EventData": "EventData",
          "EventID": "EventID",
          "GroupName": "GroupName",
          "ObjectName": "ObjectName",
          "ObjectTier": "ObjectTier",
          "ObjectType": "ObjectType",
          "OperationType": "OperationType"
        },
        "description": "Adding a Tier 0 object to the Allow RODC Password Replication Group.\n",
        "displayName": "PROD (TM017.1) - GROUP - Tier 0 Added to Allow RODC Password Replication Group",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "ObjectName",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "GroupName",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "Computer",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "Account",
                "identifier": "FullName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM017_GROUPTier0AddedToAllowRODCPasswordReplicationGroup.yaml",
        "query": "SecurityEvent \n| where EventID == 5136\n    and Activity has \"modified\"\n    and EventData matches regex \"(?i)CN=Allowed RODC Password Replication Group,CN=Users\"\n    and EventData has '\"AttributeLDAPDisplayName\">member'\n    and EventData has 'OperationType\">14674', \"Added\", tostring(OperationType))\n| project TimeGenerated \n        , ObjectName\n        , ObjectTier\n        , ObjectType = AccountType\n        , GroupName\n        , ActivityType\n        , OperationType\n        , Account\n        , Domain\n        , Computer\n        , Channel\n        , EventID\n        , EventData\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [
          "T1078.002"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1078"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}