DSRM Account Abuse

Back


Id	979c42dd-533e-4ede-b18b-31a84ba8b3d6
Rulename	DSRM Account Abuse
Description	This query detects an abuse of the DSRM account in order to maintain persistence and access to the organization’s Active Directory. Ref: https://adsecurity.org/?p=1785
Severity	High
Tactics	Persistence
Techniques	T1098
Required data connectors	SecurityEvents
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Detections/SecurityEvent/DSRMAccountAbuse.yaml
Version	1.0.3
Arm template	979c42dd-533e-4ede-b18b-31a84ba8b3d6.json

KQL

Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID in (13)
| parse EventData with * 'ProcessId">' ProcessId "<"* 'Image">' Image "<" * 'TargetObject">' TargetObject "<" * 'Details">' Details "<" * 'User">' User "<" * 
| where TargetObject has ("HKLM\\System\\CurrentControlSet\\Control\\Lsa\\DsrmAdminLogonBehavior") and Details == "DWORD (0x00000002)"
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, User, ProcessId, Image, TargetObject, Details, _ResourceId
| extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
| extend AccountName = tostring(split(User, "\\")[1]), AccountNTDomain = tostring(split(User, "\\")[0])
| extend ImageFileName = tostring(split(Image, "\\")[-1])
| extend ImageDirectory = replace_string(Image, ImageFileName, "")
| project-away DomainIndex

YAML

tactics:
- Persistence
relevantTechniques:
- T1098
version: 1.0.3
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/SecurityEvent/DSRMAccountAbuse.yaml
id: 979c42dd-533e-4ede-b18b-31a84ba8b3d6
description: |
  'This query detects an abuse of the DSRM account in order to maintain persistence and access to the organization's Active Directory.
  Ref: https://adsecurity.org/?p=1785'  
metadata:
  author:
    name: Vasileios Paschalidis
  support:
    tier: Community
  source:
    kind: Community
  categories:
    domains:
    - Security - Others
name: DSRM Account Abuse
requiredDataConnectors:
- dataTypes:
  - SecurityEvent
  connectorId: SecurityEvents
severity: High
query: |
  Event
  | where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID in (13)
  | parse EventData with * 'ProcessId">' ProcessId "<"* 'Image">' Image "<" * 'TargetObject">' TargetObject "<" * 'Details">' Details "<" * 'User">' User "<" * 
  | where TargetObject has ("HKLM\\System\\CurrentControlSet\\Control\\Lsa\\DsrmAdminLogonBehavior") and Details == "DWORD (0x00000002)"
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, User, ProcessId, Image, TargetObject, Details, _ResourceId
  | extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
  | extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
  | extend AccountName = tostring(split(User, "\\")[1]), AccountNTDomain = tostring(split(User, "\\")[0])
  | extend ImageFileName = tostring(split(Image, "\\")[-1])
  | extend ImageDirectory = replace_string(Image, ImageFileName, "")
  | project-away DomainIndex  
queryFrequency: 1h
queryPeriod: 1h
kind: Scheduled
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: Computer
  - identifier: HostName
    columnName: HostName
  - identifier: DnsDomain
    columnName: HostNameDomain
  entityType: Host
- fieldMappings:
  - identifier: FullName
    columnName: User
  - identifier: Name
    columnName: AccountName
  - identifier: NTDomain
    columnName: AccountNTDomain
  entityType: Account
- fieldMappings:
  - identifier: ProcessId
    columnName: ProcessId
  entityType: Process
- fieldMappings:
  - identifier: Name
    columnName: ImageFileName
  - identifier: Directory
    columnName: ImageDirectory
  entityType: File
- fieldMappings:
  - identifier: Key
    columnName: TargetObject
  entityType: RegistryKey
triggerThreshold: 0

ARM