AR Microsoft Sentinel Analytic Rules ONLINE

Analytic rule catalog

PROD TM0091 - ACL - Modified at Root of the Domain

Back
Id7437402c-800b-4cf3-90d9-0c1f12204375
RulenamePROD (TM009.1) - ACL - Modified at Root of the Domain
DescriptionACL Modification at the Root of the Domain.
SeverityHigh
TacticsDefenseEvasion
TechniquesT1222.001
Required data connectorsSecurityEvents
WindowsSecurityEvents
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM009_ACLModifiedAtRootOfTheDomain.yaml
Version1.0.0
Arm template7437402c-800b-4cf3-90d9-0c1f12204375.json
Deploy To Azure
SecurityEvent 
| where EventID == 5136 
    and EventData matches regex @"(?i)DC="
    and Activity has "modified" 
    and EventData has '"ObjectClass">domainDNS'
    and EventData has '<Data Name="AttributeLDAPDisplayName">nTSecurityDescriptor</Data>'
    and EventData has '"OperationType">%%14674'
| extend ObjectName = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
| where ObjectName startswith "DC=" or ObjectName startswith "dc="
| extend ObjectTier = "Tier 0"
| extend AttributeLDAP = extract("<Data Name=\"AttributeLDAPDisplayName\">([^<]+)</Data>", 1, EventData)
| extend AttributeValue = extract("\\[([^\\]]+)\\]", 1, EventData)
| extend OperationType = iff(EventData has 'nTSecurityDescriptor', "ACL Modified", tostring(OperationType))
| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| project TimeGenerated
   , ObjectName
   , ObjectTier
   , ObjectClass
   , OperationType
   , ActivityType
   , AttributeLDAP
   , Account
   , Domain
   , Computer
   , Channel
   , EventID
   , EventData

version: 1.0.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM009_ACLModifiedAtRootOfTheDomain.yaml
triggerThreshold: 0
requiredDataConnectors:
- dataTypes:
  - SecurityEvent
  connectorId: SecurityEvents
- dataTypes:
  - SecurityEvent
  connectorId: WindowsSecurityEvents
tactics:
- DefenseEvasion
relevantTechniques:
- T1222.001
eventGroupingSettings:
  aggregationKind: AlertPerResult
incidentConfiguration:
  groupingConfiguration:
    matchingMethod: AllEntities
    lookbackDuration: PT5H
    reopenClosedIncident: false
    enabled: false
  createIncident: true
alertDetailsOverride:
  alertDescriptionFormat: Any ACL changes at the root of the domain could impact or bypass the Tier Model security controls.
  alertDisplayNameFormat: (TM009.1) A Tier 0 ACL was modified at the Root of the Domain
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: ObjectName
  entityType: Account
- fieldMappings:
  - identifier: HostName
    columnName: Computer
  entityType: Host
- fieldMappings:
  - identifier: FullName
    columnName: Account
  entityType: Account
description: |
  ACL Modification at the Root of the Domain.
triggerOperator: gt
kind: Scheduled
status: Available
queryFrequency: 5m
id: 7437402c-800b-4cf3-90d9-0c1f12204375
name: PROD (TM009.1) - ACL - Modified at Root of the Domain
severity: High
query: |
  SecurityEvent 
  | where EventID == 5136 
      and EventData matches regex @"(?i)DC="
      and Activity has "modified" 
      and EventData has '"ObjectClass">domainDNS'
      and EventData has '<Data Name="AttributeLDAPDisplayName">nTSecurityDescriptor</Data>'
      and EventData has '"OperationType">%%14674'
  | extend ObjectName = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
  | where ObjectName startswith "DC=" or ObjectName startswith "dc="
  | extend ObjectTier = "Tier 0"
  | extend AttributeLDAP = extract("<Data Name=\"AttributeLDAPDisplayName\">([^<]+)</Data>", 1, EventData)
  | extend AttributeValue = extract("\\[([^\\]]+)\\]", 1, EventData)
  | extend OperationType = iff(EventData has 'nTSecurityDescriptor', "ACL Modified", tostring(OperationType))
  | extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
  | extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
  | extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
  | project TimeGenerated
     , ObjectName
     , ObjectTier
     , ObjectClass
     , OperationType
     , ActivityType
     , AttributeLDAP
     , Account
     , Domain
     , Computer
     , Channel
     , EventID
     , EventData
queryPeriod: 5m
customDetails:
  ObjectName: ObjectName
  Channel: Channel
  Domain: Domain
  ObjectTier: ObjectTier
  OperationType: OperationType
  EventData: EventData
  ActivityType: ActivityType
  AttributeLDAP: AttributeLDAP
  EventID: EventID
  ObjectClass: ObjectClass
  Computer: Computer
  Account: Account

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/7437402c-800b-4cf3-90d9-0c1f12204375')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/7437402c-800b-4cf3-90d9-0c1f12204375')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Any ACL changes at the root of the domain could impact or bypass the Tier Model security controls.",
          "alertDisplayNameFormat": "(TM009.1) A Tier 0 ACL was modified at the Root of the Domain"
        },
        "alertRuleTemplateName": "7437402c-800b-4cf3-90d9-0c1f12204375",
        "customDetails": {
          "Account": "Account",
          "ActivityType": "ActivityType",
          "AttributeLDAP": "AttributeLDAP",
          "Channel": "Channel",
          "Computer": "Computer",
          "Domain": "Domain",
          "EventData": "EventData",
          "EventID": "EventID",
          "ObjectClass": "ObjectClass",
          "ObjectName": "ObjectName",
          "ObjectTier": "ObjectTier",
          "OperationType": "OperationType"
        },
        "description": "ACL Modification at the Root of the Domain.\n",
        "displayName": "PROD (TM009.1) - ACL - Modified at Root of the Domain",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "ObjectName",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "Computer",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "Account",
                "identifier": "FullName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM009_ACLModifiedAtRootOfTheDomain.yaml",
        "query": "SecurityEvent \n| where EventID == 5136 \n    and EventData matches regex @\"(?i)DC=\"\n    and Activity has \"modified\" \n    and EventData has '\"ObjectClass\">domainDNS'\n    and EventData has '<Data Name=\"AttributeLDAPDisplayName\">nTSecurityDescriptor</Data>'\n    and EventData has '\"OperationType\">%%14674'\n| extend ObjectName = extract(\"<Data Name=\\\"ObjectDN\\\">([^<]+)</Data>\", 1, EventData)\n| where ObjectName startswith \"DC=\" or ObjectName startswith \"dc=\"\n| extend ObjectTier = \"Tier 0\"\n| extend AttributeLDAP = extract(\"<Data Name=\\\"AttributeLDAPDisplayName\\\">([^<]+)</Data>\", 1, EventData)\n| extend AttributeValue = extract(\"\\\\[([^\\\\]]+)\\\\]\", 1, EventData)\n| extend OperationType = iff(EventData has 'nTSecurityDescriptor', \"ACL Modified\", tostring(OperationType))\n| extend ActivityType = extract(\"([a-zA-Z]+)\\\\.$\", 1, Activity)\n| extend ObjectClass = extract(\"<Data Name=\\\"ObjectClass\\\">([^<]+)</Data>\", 1, EventData)\n| extend Domain = extract(\"([^.]+\\\\.[^.]+)$\", 1, Computer)\n| project TimeGenerated\n   , ObjectName\n   , ObjectTier\n   , ObjectClass\n   , OperationType\n   , ActivityType\n   , AttributeLDAP\n   , Account\n   , Domain\n   , Computer\n   , Channel\n   , EventID\n   , EventData\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [
          "T1222.001"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion"
        ],
        "techniques": [
          "T1222"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}