AR Microsoft Sentinel Analytic Rules ONLINE

Analytic rule catalog

PROD TM0151 - ACL - Modified at KRBTGT or AdminSDHolder Object Level

Back
Ida9f94bf1-856e-40ff-a176-24f967da1e27
RulenamePROD (TM015.1) - ACL - Modified at KRBTGT or AdminSDHolder Object Level
DescriptionACL changes to the KRBTGT or AdminSDHolder special objects.
SeverityHigh
TacticsPersistence
TechniquesT1078.002
Required data connectorsSecurityEvents
WindowsSecurityEvents
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM015_ACLModifiedAtKRBTGTOrAdminSDHolderObjectLevel.yaml
Version1.0.0
Arm templatea9f94bf1-856e-40ff-a176-24f967da1e27.json
Deploy To Azure
SecurityEvent 
| where EventID == 5136 
    and (EventData matches regex @"(?i)CN=AdminSDHolder" or EventData matches regex @"(?i)CN=krbtgt")
    and Activity has "modified"
    and (EventData has '"ObjectClass">container' or EventData matches regex @"(?i)user")
    and EventData has '<Data Name="AttributeLDAPDisplayName">nTSecurityDescriptor</Data>' 
    and EventData has '"OperationType">%%14674'
| extend ObjectName = extract("<Data Name=\"ObjectDN\">(((?i)CN=[^,]+,?)+),[dD][cC]=", 1, EventData)
| extend ObjectTier = "Tier 0"
| extend AttributeLDAP = extract("<Data Name=\"AttributeLDAPDisplayName\">([^<]+)</Data>", 1, EventData)
| extend OperationType = iff(EventData has 'nTSecurityDescriptor', "ACL Modified", tostring(OperationType))
| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| project TimeGenerated
   , ObjectName
   , ObjectTier
   , ObjectClass
   , OperationType
   , ActivityType
   , AttributeLDAP
   , Account
   , Domain
   , Computer
   , Channel
   , EventID
   , EventData

incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: PT5H
    reopenClosedIncident: false
    matchingMethod: AllEntities
    enabled: false
  createIncident: true
name: PROD (TM015.1) - ACL - Modified at KRBTGT or AdminSDHolder Object Level
triggerOperator: gt
query: |
  SecurityEvent 
  | where EventID == 5136 
      and (EventData matches regex @"(?i)CN=AdminSDHolder" or EventData matches regex @"(?i)CN=krbtgt")
      and Activity has "modified"
      and (EventData has '"ObjectClass">container' or EventData matches regex @"(?i)user")
      and EventData has '<Data Name="AttributeLDAPDisplayName">nTSecurityDescriptor</Data>' 
      and EventData has '"OperationType">%%14674'
  | extend ObjectName = extract("<Data Name=\"ObjectDN\">(((?i)CN=[^,]+,?)+),[dD][cC]=", 1, EventData)
  | extend ObjectTier = "Tier 0"
  | extend AttributeLDAP = extract("<Data Name=\"AttributeLDAPDisplayName\">([^<]+)</Data>", 1, EventData)
  | extend OperationType = iff(EventData has 'nTSecurityDescriptor', "ACL Modified", tostring(OperationType))
  | extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
  | extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
  | extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
  | project TimeGenerated
     , ObjectName
     , ObjectTier
     , ObjectClass
     , OperationType
     , ActivityType
     , AttributeLDAP
     , Account
     , Domain
     , Computer
     , Channel
     , EventID
     , EventData
queryFrequency: 5m
description: |
  ACL changes to the KRBTGT or AdminSDHolder special objects.
id: a9f94bf1-856e-40ff-a176-24f967da1e27
triggerThreshold: 0
queryPeriod: 5m
version: 1.0.0
kind: Scheduled
customDetails:
  ObjectTier: ObjectTier
  Computer: Computer
  EventID: EventID
  OperationType: OperationType
  AttributeLDAP: AttributeLDAP
  ObjectClass: ObjectClass
  EventData: EventData
  Account: Account
  ObjectName: ObjectName
  Domain: Domain
  Channel: Channel
  ActivityType: ActivityType
status: Available
eventGroupingSettings:
  aggregationKind: AlertPerResult
severity: High
requiredDataConnectors:
- connectorId: SecurityEvents
  dataTypes:
  - SecurityEvent
- connectorId: WindowsSecurityEvents
  dataTypes:
  - SecurityEvent
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM015_ACLModifiedAtKRBTGTOrAdminSDHolderObjectLevel.yaml
alertDetailsOverride:
  alertDescriptionFormat: The following user {{Account}} modified the {{ObjectName}} ACLs.
  alertDisplayNameFormat: (TM015.1) The {{ObjectTier}} {{ObjectName}} ACL was modified
relevantTechniques:
- T1078.002
tactics:
- Persistence
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: ObjectName
  entityType: Account
- fieldMappings:
  - identifier: HostName
    columnName: Computer
  entityType: Host
- fieldMappings:
  - identifier: FullName
    columnName: Account
  entityType: Account

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/a9f94bf1-856e-40ff-a176-24f967da1e27')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/a9f94bf1-856e-40ff-a176-24f967da1e27')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "The following user {{Account}} modified the {{ObjectName}} ACLs.",
          "alertDisplayNameFormat": "(TM015.1) The {{ObjectTier}} {{ObjectName}} ACL was modified"
        },
        "alertRuleTemplateName": "a9f94bf1-856e-40ff-a176-24f967da1e27",
        "customDetails": {
          "Account": "Account",
          "ActivityType": "ActivityType",
          "AttributeLDAP": "AttributeLDAP",
          "Channel": "Channel",
          "Computer": "Computer",
          "Domain": "Domain",
          "EventData": "EventData",
          "EventID": "EventID",
          "ObjectClass": "ObjectClass",
          "ObjectName": "ObjectName",
          "ObjectTier": "ObjectTier",
          "OperationType": "OperationType"
        },
        "description": "ACL changes to the KRBTGT or AdminSDHolder special objects.\n",
        "displayName": "PROD (TM015.1) - ACL - Modified at KRBTGT or AdminSDHolder Object Level",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "ObjectName",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "Computer",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "Account",
                "identifier": "FullName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM015_ACLModifiedAtKRBTGTOrAdminSDHolderObjectLevel.yaml",
        "query": "SecurityEvent \n| where EventID == 5136 \n    and (EventData matches regex @\"(?i)CN=AdminSDHolder\" or EventData matches regex @\"(?i)CN=krbtgt\")\n    and Activity has \"modified\"\n    and (EventData has '\"ObjectClass\">container' or EventData matches regex @\"(?i)user\")\n    and EventData has '<Data Name=\"AttributeLDAPDisplayName\">nTSecurityDescriptor</Data>' \n    and EventData has '\"OperationType\">%%14674'\n| extend ObjectName = extract(\"<Data Name=\\\"ObjectDN\\\">(((?i)CN=[^,]+,?)+),[dD][cC]=\", 1, EventData)\n| extend ObjectTier = \"Tier 0\"\n| extend AttributeLDAP = extract(\"<Data Name=\\\"AttributeLDAPDisplayName\\\">([^<]+)</Data>\", 1, EventData)\n| extend OperationType = iff(EventData has 'nTSecurityDescriptor', \"ACL Modified\", tostring(OperationType))\n| extend ActivityType = extract(\"([a-zA-Z]+)\\\\.$\", 1, Activity)\n| extend ObjectClass = extract(\"<Data Name=\\\"ObjectClass\\\">([^<]+)</Data>\", 1, EventData)\n| extend Domain = extract(\"([^.]+\\\\.[^.]+)$\", 1, Computer)\n| project TimeGenerated\n   , ObjectName\n   , ObjectTier\n   , ObjectClass\n   , OperationType\n   , ActivityType\n   , AttributeLDAP\n   , Account\n   , Domain\n   , Computer\n   , Channel\n   , EventID\n   , EventData\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [
          "T1078.002"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Persistence"
        ],
        "techniques": [
          "T1078"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}