Silverfort - NTDSdit extraction | Microsoft Sentinel Analytic Rules

Back


Id	cc110738-a263-5cfa-ac76-a991f3e3a2df
Rulename	Silverfort - NTDS.dit extraction
Description	Identifies Silverfort incidents involving potential extraction of the NTDS.dit Active Directory database. Access to this database may expose domain account password hashes for credential theft.
Severity	High
Tactics	CredentialAccess
Techniques	T1003.003
Required data connectors	SilverfortAma
Kind	Scheduled
Query frequency	15m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Silverfort/Analytic%20Rules/NtdsDitDump.yaml
Version	1.0.0
Arm template	cc110738-a263-5cfa-ac76-a991f3e3a2df.json

KQL

CommonSecurityLog
| where DeviceVendor has 'Silverfort'
| where DeviceProduct has 'Admin Console'
| where DeviceEventClassID == "NewIncident"
| where Message has "NtdsDitDump"
| extend IncidentData = parse_json(replace('^""|""$', '', Message))
| extend IncidentKind = coalesce(tostring(IncidentData.data.kind), tostring(IncidentData.kind))
| extend IncidentId = tostring(coalesce(IncidentData.data.id, IncidentData.id))
| extend IncidentSummary = tostring(coalesce(IncidentData.data.summary, IncidentData.summary))
| extend UserName = coalesce(
    tostring(IncidentData.data.users[0].samAccountName),
    tostring(IncidentData.data.users[0].upn),
    tostring(IncidentData.data.users[0].displayName),
    tostring(IncidentData.users[0].displayName)
)
| extend SourceHost = coalesce(
    tostring(IncidentData.data.sources[0].displayName),
    tostring(IncidentData.sources[0].displayName)
)
| extend DestinationHost = coalesce(
    tostring(IncidentData.data.destinations[0].displayName),
    tostring(IncidentData.destinations[0].displayName)
)

YAML

queryFrequency: 15m
entityMappings:
- fieldMappings:
  - columnName: UserName
    identifier: Name
  entityType: Account
- fieldMappings:
  - columnName: SourceHost
    identifier: HostName
  entityType: Host
- fieldMappings:
  - columnName: DestinationHost
    identifier: HostName
  entityType: Host
triggerThreshold: 0
triggerOperator: gt
severity: High
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Silverfort/Analytic%20Rules/NtdsDitDump.yaml
query: |-
  CommonSecurityLog
  | where DeviceVendor has 'Silverfort'
  | where DeviceProduct has 'Admin Console'
  | where DeviceEventClassID == "NewIncident"
  | where Message has "NtdsDitDump"
  | extend IncidentData = parse_json(replace('^""|""$', '', Message))
  | extend IncidentKind = coalesce(tostring(IncidentData.data.kind), tostring(IncidentData.kind))
  | extend IncidentId = tostring(coalesce(IncidentData.data.id, IncidentData.id))
  | extend IncidentSummary = tostring(coalesce(IncidentData.data.summary, IncidentData.summary))
  | extend UserName = coalesce(
      tostring(IncidentData.data.users[0].samAccountName),
      tostring(IncidentData.data.users[0].upn),
      tostring(IncidentData.data.users[0].displayName),
      tostring(IncidentData.users[0].displayName)
  )
  | extend SourceHost = coalesce(
      tostring(IncidentData.data.sources[0].displayName),
      tostring(IncidentData.sources[0].displayName)
  )
  | extend DestinationHost = coalesce(
      tostring(IncidentData.data.destinations[0].displayName),
      tostring(IncidentData.destinations[0].displayName)
  )
tactics:
- CredentialAccess
queryPeriod: 15m
customDetails:
  IncidentReference: IncidentId
  IncidentKind: IncidentKind
  IncidentSummary: IncidentSummary
relevantTechniques:
- T1003.003
requiredDataConnectors:
- connectorId: SilverfortAma
  dataTypes:
  - CommonSecurityLog
id: cc110738-a263-5cfa-ac76-a991f3e3a2df
kind: Scheduled
version: 1.0.0
description: |
  Identifies Silverfort incidents involving potential extraction of the NTDS.dit Active Directory database. Access to this database may expose domain account password hashes for credential theft.
status: Available
name: Silverfort - NTDS.dit extraction

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/cc110738-a263-5cfa-ac76-a991f3e3a2df')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/cc110738-a263-5cfa-ac76-a991f3e3a2df')]",
      "properties": {
        "alertRuleTemplateName": "cc110738-a263-5cfa-ac76-a991f3e3a2df",
        "customDetails": {
          "IncidentKind": "IncidentKind",
          "IncidentReference": "IncidentId",
          "IncidentSummary": "IncidentSummary"
        },
        "description": "Identifies Silverfort incidents involving potential extraction of the NTDS.dit Active Directory database. Access to this database may expose domain account password hashes for credential theft.\n",
        "displayName": "Silverfort - NTDS.dit extraction",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "UserName",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "SourceHost",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "DestinationHost",
                "identifier": "HostName"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Silverfort/Analytic%20Rules/NtdsDitDump.yaml",
        "query": "CommonSecurityLog\n| where DeviceVendor has 'Silverfort'\n| where DeviceProduct has 'Admin Console'\n| where DeviceEventClassID == \"NewIncident\"\n| where Message has \"NtdsDitDump\"\n| extend IncidentData = parse_json(replace('^\"\"|\"\"$', '', Message))\n| extend IncidentKind = coalesce(tostring(IncidentData.data.kind), tostring(IncidentData.kind))\n| extend IncidentId = tostring(coalesce(IncidentData.data.id, IncidentData.id))\n| extend IncidentSummary = tostring(coalesce(IncidentData.data.summary, IncidentData.summary))\n| extend UserName = coalesce(\n    tostring(IncidentData.data.users[0].samAccountName),\n    tostring(IncidentData.data.users[0].upn),\n    tostring(IncidentData.data.users[0].displayName),\n    tostring(IncidentData.users[0].displayName)\n)\n| extend SourceHost = coalesce(\n    tostring(IncidentData.data.sources[0].displayName),\n    tostring(IncidentData.sources[0].displayName)\n)\n| extend DestinationHost = coalesce(\n    tostring(IncidentData.data.destinations[0].displayName),\n    tostring(IncidentData.destinations[0].displayName)\n)",
        "queryFrequency": "PT15M",
        "queryPeriod": "PT15M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [
          "T1003.003"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess"
        ],
        "techniques": [
          "T1003"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}