Analytic rule catalog
PROD TM0161 - GROUP - Added to Well-Known or Tier Model Group
Back
| Id | 763fc00b-4971-43c2-9cd1-f12b58a542bd |
| Rulename | PROD (TM016.1) - GROUP - Added to Well-Known or Tier Model Group |
| Description | Well-Known Groups are classified as Tier 0, and Tier Model groups that provide permission over Tier Model objects. |
| Severity | High |
| Tactics | PrivilegeEscalation |
| Techniques | T1078.002 |
| Required data connectors | SecurityEvents WindowsSecurityEvents |
| Kind | Scheduled |
| Query frequency | 5m |
| Query period | 5m |
| Trigger threshold | 0 |
| Trigger operator | gt |
| Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM016_GROUPAddedToWellKnownOrTierModelGroup.yaml |
| Version | 1.0.0 |
| Arm template | 763fc00b-4971-43c2-9cd1-f12b58a542bd.json |
let adminGroups = dynamic([
"CN=Domain Admins,CN=Users",
"CN=Enterprise Admins,CN=Users",
"CN=Administrators,CN=Builtin",
"CN=Cert Publishers,CN=Users",
"CN=Cloneable Domain Controllers,CN=Users",
"CN=Denied RODC Password Replication Group,CN=Users",
"CN=DnsAdmins,CN=Users",
"CN=DnsUpdateProxy,CN=Users",
"CN=Domain Controllers,CN=Users",
"CN=Domain Guests,CN=Users",
"CN=Enterprise Key Admins,CN=Users",
"CN=Enterprise Read-only Domain Controllers,CN=Users",
"CN=External Trust Accounts,CN=Users",
"CN=Forest Trust Accounts,CN=Users",
"CN=Group Policy Creator Owners,CN=Users",
"CN=Key Admins,CN=Users",
"CN=RAS and IAS Servers,CN=Users",
"CN=Read-only Domain Controllers,CN=Users",
"CN=Schema Admins,CN=Users",
"CN=Access Control Assistance Operators,CN=Builtin",
"CN=Account Operators,CN=Builtin",
"CN=Backup Operators,CN=Builtin",
"CN=Certificate Service DCOM Access,CN=Builtin",
"CN=Cryptographic Operators,CN=Builtin",
"CN=Distributed COM Users,CN=Builtin",
"CN=Event Log Readers,CN=Builtin",
"CN=Guests,CN=Builtin",
"CN=Hyper-V Administrators,CN=Builtin",
"CN=IIS_IUSRS,CN=Builtin",
"CN=Incoming Forest Trust Builders,CN=Builtin",
"CN=Network Configuration Operators,CN=Builtin",
"CN=OpenSSH Users,CN=Builtin",
"CN=Performance Log Users,CN=Builtin",
"CN=Performance Monitor Users,CN=Builtin",
"CN=Pre-Windows 2000 Compatible Access,CN=Builtin",
"CN=Print Operators,CN=Builtin",
"CN=RDS Endpoint Servers,CN=Builtin",
"CN=RDS Management Servers,CN=Builtin",
"CN=RDS Remote Access Servers,CN=Builtin",
"CN=Remote Desktop Users,CN=Builtin",
"CN=Remote Management Users,CN=Builtin",
"CN=Replicator,CN=Builtin",
"CN=Server Operators,CN=Builtin",
"CN=Storage Replica Administrators,CN=Builtin",
"CN=Terminal Server License Servers,CN=Builtin",
"CN=Users,CN=Builtin",
"CN=Windows Authorization Access Group,CN=Builtin",
"CN=Tier 0 Admins,OU=Tier 0 Groups,OU=Tier 0,OU=Tier Model Administration",
"CN=Tier 0 Server Operators,OU=Tier 0 Groups,OU=Tier 0,OU=Tier Model Administration",
"CN=Tier 1 Admins,OU=Tier 1 Groups,OU=Tier 1,OU=Tier Model Administration",
"CN=Tier 1 Server Operators,OU=Tier 1 Groups,OU=Tier 1,OU=Tier Model Administration",
"CN=Tier 2 Admins,OU=Tier 2 Groups,OU=Tier 2,OU=Tier Model Administration"
]);
SecurityEvent
| where EventID == 5136
| extend EventData = tostring(EventData)
| where EventData has_any(adminGroups)
and EventData has '"AttributeLDAPDisplayName">member'
and EventData has 'OperationType">%%14674'
| extend GroupName_e = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
| extend GroupName = extract("(?i)CN=([^,]+)", 1, GroupName_e)
| extend GroupTier = case(
GroupName has "Tier 0", "Tier 0",
GroupName has "Tier 1", "Tier 1",
GroupName has "Tier 2", "Tier 2",
"Tier 0")
| extend ObjectName_e = extract("<Data Name=\"AttributeValue\">([^<]+)</Data>", 1, EventData)
| extend ObjectName = extract("(?i)CN=([^,]+)", 1, ObjectName_e)
| extend ObjectTier = case(
ObjectName_e has "Tier 0", "Tier 0",
ObjectName_e has "Tier 1", "Tier 1",
ObjectName_e has "Tier 2", "Tier 2",
"Outside Tier Model")
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
| extend SubjectUserName = extract("<Data Name=\"SubjectUserName\">([^<]+)</Data>", 1, EventData)
| extend SubjectDomainName = extract("<Data Name=\"SubjectDomainName\">([^<]+)</Data>", 1, EventData)
| extend Account = strcat(SubjectDomainName, "\\", SubjectUserName)
| extend OperationType = iff(EventData has 'OperationType">%%14674', "Added", tostring(OperationType))
| project TimeGenerated
, ObjectName
, ObjectTier
, ObjectType = AccountType
, GroupName
, GroupTier
, ActivityType
, OperationType
, Account
, Domain
, Computer
, Channel
, EventID
, EventData
incidentConfiguration:
groupingConfiguration:
lookbackDuration: PT5H
reopenClosedIncident: false
matchingMethod: AllEntities
enabled: false
createIncident: true
name: PROD (TM016.1) - GROUP - Added to Well-Known or Tier Model Group
triggerOperator: gt
query: |
let adminGroups = dynamic([
"CN=Domain Admins,CN=Users",
"CN=Enterprise Admins,CN=Users",
"CN=Administrators,CN=Builtin",
"CN=Cert Publishers,CN=Users",
"CN=Cloneable Domain Controllers,CN=Users",
"CN=Denied RODC Password Replication Group,CN=Users",
"CN=DnsAdmins,CN=Users",
"CN=DnsUpdateProxy,CN=Users",
"CN=Domain Controllers,CN=Users",
"CN=Domain Guests,CN=Users",
"CN=Enterprise Key Admins,CN=Users",
"CN=Enterprise Read-only Domain Controllers,CN=Users",
"CN=External Trust Accounts,CN=Users",
"CN=Forest Trust Accounts,CN=Users",
"CN=Group Policy Creator Owners,CN=Users",
"CN=Key Admins,CN=Users",
"CN=RAS and IAS Servers,CN=Users",
"CN=Read-only Domain Controllers,CN=Users",
"CN=Schema Admins,CN=Users",
"CN=Access Control Assistance Operators,CN=Builtin",
"CN=Account Operators,CN=Builtin",
"CN=Backup Operators,CN=Builtin",
"CN=Certificate Service DCOM Access,CN=Builtin",
"CN=Cryptographic Operators,CN=Builtin",
"CN=Distributed COM Users,CN=Builtin",
"CN=Event Log Readers,CN=Builtin",
"CN=Guests,CN=Builtin",
"CN=Hyper-V Administrators,CN=Builtin",
"CN=IIS_IUSRS,CN=Builtin",
"CN=Incoming Forest Trust Builders,CN=Builtin",
"CN=Network Configuration Operators,CN=Builtin",
"CN=OpenSSH Users,CN=Builtin",
"CN=Performance Log Users,CN=Builtin",
"CN=Performance Monitor Users,CN=Builtin",
"CN=Pre-Windows 2000 Compatible Access,CN=Builtin",
"CN=Print Operators,CN=Builtin",
"CN=RDS Endpoint Servers,CN=Builtin",
"CN=RDS Management Servers,CN=Builtin",
"CN=RDS Remote Access Servers,CN=Builtin",
"CN=Remote Desktop Users,CN=Builtin",
"CN=Remote Management Users,CN=Builtin",
"CN=Replicator,CN=Builtin",
"CN=Server Operators,CN=Builtin",
"CN=Storage Replica Administrators,CN=Builtin",
"CN=Terminal Server License Servers,CN=Builtin",
"CN=Users,CN=Builtin",
"CN=Windows Authorization Access Group,CN=Builtin",
"CN=Tier 0 Admins,OU=Tier 0 Groups,OU=Tier 0,OU=Tier Model Administration",
"CN=Tier 0 Server Operators,OU=Tier 0 Groups,OU=Tier 0,OU=Tier Model Administration",
"CN=Tier 1 Admins,OU=Tier 1 Groups,OU=Tier 1,OU=Tier Model Administration",
"CN=Tier 1 Server Operators,OU=Tier 1 Groups,OU=Tier 1,OU=Tier Model Administration",
"CN=Tier 2 Admins,OU=Tier 2 Groups,OU=Tier 2,OU=Tier Model Administration"
]);
SecurityEvent
| where EventID == 5136
| extend EventData = tostring(EventData)
| where EventData has_any(adminGroups)
and EventData has '"AttributeLDAPDisplayName">member'
and EventData has 'OperationType">%%14674'
| extend GroupName_e = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
| extend GroupName = extract("(?i)CN=([^,]+)", 1, GroupName_e)
| extend GroupTier = case(
GroupName has "Tier 0", "Tier 0",
GroupName has "Tier 1", "Tier 1",
GroupName has "Tier 2", "Tier 2",
"Tier 0")
| extend ObjectName_e = extract("<Data Name=\"AttributeValue\">([^<]+)</Data>", 1, EventData)
| extend ObjectName = extract("(?i)CN=([^,]+)", 1, ObjectName_e)
| extend ObjectTier = case(
ObjectName_e has "Tier 0", "Tier 0",
ObjectName_e has "Tier 1", "Tier 1",
ObjectName_e has "Tier 2", "Tier 2",
"Outside Tier Model")
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
| extend SubjectUserName = extract("<Data Name=\"SubjectUserName\">([^<]+)</Data>", 1, EventData)
| extend SubjectDomainName = extract("<Data Name=\"SubjectDomainName\">([^<]+)</Data>", 1, EventData)
| extend Account = strcat(SubjectDomainName, "\\", SubjectUserName)
| extend OperationType = iff(EventData has 'OperationType">%%14674', "Added", tostring(OperationType))
| project TimeGenerated
, ObjectName
, ObjectTier
, ObjectType = AccountType
, GroupName
, GroupTier
, ActivityType
, OperationType
, Account
, Domain
, Computer
, Channel
, EventID
, EventData
queryFrequency: 5m
description: |
Well-Known Groups are classified as Tier 0, and Tier Model groups that provide permission over Tier Model objects.
id: 763fc00b-4971-43c2-9cd1-f12b58a542bd
triggerThreshold: 0
queryPeriod: 5m
version: 1.0.0
kind: Scheduled
customDetails:
ObjectTier: ObjectTier
Computer: Computer
ObjectType: ObjectType
GroupTier: GroupTier
EventID: EventID
OperationType: OperationType
GroupName: GroupName
EventData: EventData
Account: Account
ObjectName: ObjectName
Domain: Domain
Channel: Channel
ActivityType: ActivityType
status: Available
eventGroupingSettings:
aggregationKind: AlertPerResult
severity: High
requiredDataConnectors:
- connectorId: SecurityEvents
dataTypes:
- SecurityEvent
- connectorId: WindowsSecurityEvents
dataTypes:
- SecurityEvent
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM016_GROUPAddedToWellKnownOrTierModelGroup.yaml
alertDetailsOverride:
alertDescriptionFormat: The following object {{ObjectName}} was added to a {{ObjectTier}} Well-Known or Tier Model high privilege group.
alertDisplayNameFormat: (TM016.1) A member was added to {{GroupName}} which is a Well-Known or Tier Model Group
relevantTechniques:
- T1078.002
tactics:
- PrivilegeEscalation
entityMappings:
- fieldMappings:
- identifier: FullName
columnName: ObjectName
entityType: Account
- fieldMappings:
- identifier: HostName
columnName: Computer
entityType: Host
- fieldMappings:
- identifier: FullName
columnName: Account
entityType: Account
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/763fc00b-4971-43c2-9cd1-f12b58a542bd')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/763fc00b-4971-43c2-9cd1-f12b58a542bd')]",
"properties": {
"alertDetailsOverride": {
"alertDescriptionFormat": "The following object {{ObjectName}} was added to a {{ObjectTier}} Well-Known or Tier Model high privilege group.",
"alertDisplayNameFormat": "(TM016.1) A member was added to {{GroupName}} which is a Well-Known or Tier Model Group"
},
"alertRuleTemplateName": "763fc00b-4971-43c2-9cd1-f12b58a542bd",
"customDetails": {
"Account": "Account",
"ActivityType": "ActivityType",
"Channel": "Channel",
"Computer": "Computer",
"Domain": "Domain",
"EventData": "EventData",
"EventID": "EventID",
"GroupName": "GroupName",
"GroupTier": "GroupTier",
"ObjectName": "ObjectName",
"ObjectTier": "ObjectTier",
"ObjectType": "ObjectType",
"OperationType": "OperationType"
},
"description": "Well-Known Groups are classified as Tier 0, and Tier Model groups that provide permission over Tier Model objects.\n",
"displayName": "PROD (TM016.1) - GROUP - Added to Well-Known or Tier Model Group",
"enabled": true,
"entityMappings": [
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "ObjectName",
"identifier": "FullName"
}
]
},
{
"entityType": "Host",
"fieldMappings": [
{
"columnName": "Computer",
"identifier": "HostName"
}
]
},
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "Account",
"identifier": "FullName"
}
]
}
],
"eventGroupingSettings": {
"aggregationKind": "AlertPerResult"
},
"incidentConfiguration": {
"createIncident": true,
"groupingConfiguration": {
"enabled": false,
"lookbackDuration": "PT5H",
"matchingMethod": "AllEntities",
"reopenClosedIncident": false
}
},
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM016_GROUPAddedToWellKnownOrTierModelGroup.yaml",
"query": "let adminGroups = dynamic([\n \"CN=Domain Admins,CN=Users\",\n \"CN=Enterprise Admins,CN=Users\",\n \"CN=Administrators,CN=Builtin\",\n \"CN=Cert Publishers,CN=Users\",\n \"CN=Cloneable Domain Controllers,CN=Users\",\n \"CN=Denied RODC Password Replication Group,CN=Users\",\n \"CN=DnsAdmins,CN=Users\",\n \"CN=DnsUpdateProxy,CN=Users\",\n \"CN=Domain Controllers,CN=Users\",\n \"CN=Domain Guests,CN=Users\",\n \"CN=Enterprise Key Admins,CN=Users\",\n \"CN=Enterprise Read-only Domain Controllers,CN=Users\",\n \"CN=External Trust Accounts,CN=Users\",\n \"CN=Forest Trust Accounts,CN=Users\",\n \"CN=Group Policy Creator Owners,CN=Users\",\n \"CN=Key Admins,CN=Users\",\n \"CN=RAS and IAS Servers,CN=Users\",\n \"CN=Read-only Domain Controllers,CN=Users\",\n \"CN=Schema Admins,CN=Users\",\n \"CN=Access Control Assistance Operators,CN=Builtin\",\n \"CN=Account Operators,CN=Builtin\",\n \"CN=Backup Operators,CN=Builtin\",\n \"CN=Certificate Service DCOM Access,CN=Builtin\",\n \"CN=Cryptographic Operators,CN=Builtin\",\n \"CN=Distributed COM Users,CN=Builtin\",\n \"CN=Event Log Readers,CN=Builtin\",\n \"CN=Guests,CN=Builtin\",\n \"CN=Hyper-V Administrators,CN=Builtin\",\n \"CN=IIS_IUSRS,CN=Builtin\",\n \"CN=Incoming Forest Trust Builders,CN=Builtin\",\n \"CN=Network Configuration Operators,CN=Builtin\",\n \"CN=OpenSSH Users,CN=Builtin\",\n \"CN=Performance Log Users,CN=Builtin\",\n \"CN=Performance Monitor Users,CN=Builtin\",\n \"CN=Pre-Windows 2000 Compatible Access,CN=Builtin\",\n \"CN=Print Operators,CN=Builtin\",\n \"CN=RDS Endpoint Servers,CN=Builtin\",\n \"CN=RDS Management Servers,CN=Builtin\",\n \"CN=RDS Remote Access Servers,CN=Builtin\",\n \"CN=Remote Desktop Users,CN=Builtin\",\n \"CN=Remote Management Users,CN=Builtin\",\n \"CN=Replicator,CN=Builtin\",\n \"CN=Server Operators,CN=Builtin\",\n \"CN=Storage Replica Administrators,CN=Builtin\",\n \"CN=Terminal Server License Servers,CN=Builtin\",\n \"CN=Users,CN=Builtin\",\n \"CN=Windows Authorization Access Group,CN=Builtin\",\n \"CN=Tier 0 Admins,OU=Tier 0 Groups,OU=Tier 0,OU=Tier Model Administration\",\n \"CN=Tier 0 Server Operators,OU=Tier 0 Groups,OU=Tier 0,OU=Tier Model Administration\",\n \"CN=Tier 1 Admins,OU=Tier 1 Groups,OU=Tier 1,OU=Tier Model Administration\",\n \"CN=Tier 1 Server Operators,OU=Tier 1 Groups,OU=Tier 1,OU=Tier Model Administration\",\n \"CN=Tier 2 Admins,OU=Tier 2 Groups,OU=Tier 2,OU=Tier Model Administration\"\n]);\nSecurityEvent\n| where EventID == 5136\n| extend EventData = tostring(EventData)\n| where EventData has_any(adminGroups)\n and EventData has '\"AttributeLDAPDisplayName\">member'\n and EventData has 'OperationType\">14674', \"Added\", tostring(OperationType))\n| project TimeGenerated \n , ObjectName\n , ObjectTier\n , ObjectType = AccountType\n , GroupName\n , GroupTier\n , ActivityType\n , OperationType\n , Account\n , Domain\n , Computer\n , Channel\n , EventID\n , EventData\n",
"queryFrequency": "PT5M",
"queryPeriod": "PT5M",
"severity": "High",
"status": "Available",
"subTechniques": [
"T1078.002"
],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"PrivilegeEscalation"
],
"techniques": [
"T1078"
],
"templateVersion": "1.0.0",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}