Semperis DSP Recent sIDHistory changes on AD objects

Back


Id	64796da3-6383-4de2-9c97-866c83c459ae
Rulename	Semperis DSP Recent sIDHistory changes on AD objects
Description	This indicator detects any recent changes to sIDHistory on AD objects, including changes to non-privileged accounts where privileged SIDs are added.
Severity	High
Tactics	PrivilegeEscalation Persistence
Techniques	T1098
Required data connectors	SemperisDSP
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Semperis Directory Services Protector/Analytic Rules/SemperisDSP_RecentsIDHistoryChangesOnADObjects.yaml
Version	2.0.7
Arm template	64796da3-6383-4de2-9c97-866c83c459ae.json

KQL

dsp_parser
| where EventID == 9212
| where SecurityIndicatorName == "Recent sIDHistory changes on objects"
| extend HostName = tostring(split(Computer, '.', 0)[0]), DnsDomain = tostring(strcat_array(array_slice(split(Computer, '.'), 1, -1), '.'))

YAML

tactics:
- PrivilegeEscalation
- Persistence
triggerOperator: gt
queryPeriod: 1h
queryFrequency: 1h
requiredDataConnectors:
- dataTypes:
  - dsp_parser
  connectorId: SemperisDSP
status: Available
id: 64796da3-6383-4de2-9c97-866c83c459ae
relevantTechniques:
- T1098
triggerThreshold: 0
kind: Scheduled
entityMappings:
- fieldMappings:
  - identifier: HostName
    columnName: HostName
  - identifier: DnsDomain
    columnName: DnsDomain
  entityType: Host
query: |
  dsp_parser
  | where EventID == 9212
  | where SecurityIndicatorName == "Recent sIDHistory changes on objects"
  | extend HostName = tostring(split(Computer, '.', 0)[0]), DnsDomain = tostring(strcat_array(array_slice(split(Computer, '.'), 1, -1), '.'))  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Semperis Directory Services Protector/Analytic Rules/SemperisDSP_RecentsIDHistoryChangesOnADObjects.yaml
name: Semperis DSP Recent sIDHistory changes on AD objects
version: 2.0.7
severity: High
description: |
    'This indicator detects any recent changes to sIDHistory on AD objects, including changes to non-privileged accounts where privileged SIDs are added.'

ARM