Analytic rule catalog
PROD TM0111 - LAPS - Tier Level Computer Object LAPS Password Expiration Time Set Manually
Back
| Id | daf2b9f7-dcf2-4b45-831a-d7142318c7e9 |
| Rulename | PROD (TM011.1) - LAPS - Tier Level Computer Object LAPS Password Expiration Time Set Manually |
| Description | Alert if a Tier Model computer object LAPS password was manually expired. |
| Severity | Low |
| Tactics | Discovery |
| Techniques | T1087.001 |
| Required data connectors | SecurityEvents WindowsSecurityEvents |
| Kind | Scheduled |
| Query frequency | 5h |
| Query period | 5h |
| Trigger threshold | 0 |
| Trigger operator | gt |
| Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM011_LAPSTierLevelComputerObjectLAPSPasswordExpirationTimeSetManu.yaml |
| Version | 1.0.0 |
| Arm template | daf2b9f7-dcf2-4b45-831a-d7142318c7e9.json |
SecurityEvent
| where EventID == 5136
and (EventData matches regex @"(?i)OU=Domain Controllers"
or EventData matches regex @"(?i)OU=Tier 0 PAW"
or EventData matches regex @"(?i)OU=Tier 1 PAW"
or EventData matches regex @"(?i)OU=Tier 2 PAW"
or EventData matches regex @"(?i)OU=Tier 0 Member Servers"
or EventData matches regex @"(?i)OU=Tier 1 Member Servers")
and AccountType == "User"
| extend AttributeLDAP = extract("<Data Name=\"AttributeLDAPDisplayName\">([^<]+)</Data>", 1, EventData)
| where AttributeLDAP has "msLAPS-PasswordExpirationTime"
| extend ObjectName_e = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
| extend ObjectName = extract("(?i)CN=([^,]+)", 1, ObjectName_e)
| extend ObjectTier = case(
ObjectName_e has "Tier 0", "Tier 0",
ObjectName_e has "Tier 1", "Tier 1",
ObjectName_e has "Tier Model Administration", "Tier 0",
ObjectName_e has "Tier Model Computer Quarantine", "Tier 0",
ObjectName_e has "Domain Controllers", "Tier 0",
"Unknown")
| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| extend OperationType = iff(EventData has 'OperationType">%%14674', "Added", tostring(OperationType))
| project TimeGenerated
, ObjectName
, ObjectTier
, AttributeLDAP
, ActivityType
, Account
, Domain
, Computer
, Channel
, EventID
, EventData
triggerThreshold: 0
incidentConfiguration:
createIncident: true
groupingConfiguration:
reopenClosedIncident: false
matchingMethod: AllEntities
enabled: false
lookbackDuration: PT5H
kind: Scheduled
description: |
Alert if a Tier Model computer object LAPS password was manually expired.
queryFrequency: 5h
triggerOperator: gt
relevantTechniques:
- T1087.001
entityMappings:
- fieldMappings:
- identifier: FullName
columnName: ObjectName
entityType: Account
- fieldMappings:
- identifier: HostName
columnName: Computer
entityType: Host
- fieldMappings:
- identifier: FullName
columnName: Account
entityType: Account
id: daf2b9f7-dcf2-4b45-831a-d7142318c7e9
query: |
SecurityEvent
| where EventID == 5136
and (EventData matches regex @"(?i)OU=Domain Controllers"
or EventData matches regex @"(?i)OU=Tier 0 PAW"
or EventData matches regex @"(?i)OU=Tier 1 PAW"
or EventData matches regex @"(?i)OU=Tier 2 PAW"
or EventData matches regex @"(?i)OU=Tier 0 Member Servers"
or EventData matches regex @"(?i)OU=Tier 1 Member Servers")
and AccountType == "User"
| extend AttributeLDAP = extract("<Data Name=\"AttributeLDAPDisplayName\">([^<]+)</Data>", 1, EventData)
| where AttributeLDAP has "msLAPS-PasswordExpirationTime"
| extend ObjectName_e = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
| extend ObjectName = extract("(?i)CN=([^,]+)", 1, ObjectName_e)
| extend ObjectTier = case(
ObjectName_e has "Tier 0", "Tier 0",
ObjectName_e has "Tier 1", "Tier 1",
ObjectName_e has "Tier Model Administration", "Tier 0",
ObjectName_e has "Tier Model Computer Quarantine", "Tier 0",
ObjectName_e has "Domain Controllers", "Tier 0",
"Unknown")
| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| extend OperationType = iff(EventData has 'OperationType">%%14674', "Added", tostring(OperationType))
| project TimeGenerated
, ObjectName
, ObjectTier
, AttributeLDAP
, ActivityType
, Account
, Domain
, Computer
, Channel
, EventID
, EventData
eventGroupingSettings:
aggregationKind: AlertPerResult
alertDetailsOverride:
alertDisplayNameFormat: (TM011.1) A {{ObjectTier}} LAPS password was expired by {{Account}} manually.
alertDescriptionFormat: The LAPS password for {{ObjectName}} was expired manually.
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM011_LAPSTierLevelComputerObjectLAPSPasswordExpirationTimeSetManu.yaml
version: 1.0.0
requiredDataConnectors:
- dataTypes:
- SecurityEvent
connectorId: SecurityEvents
- dataTypes:
- SecurityEvent
connectorId: WindowsSecurityEvents
customDetails:
EventID: EventID
Computer: Computer
ObjectTier: ObjectTier
Channel: Channel
ObjectName: ObjectName
Account: Account
AttributeLDAP: AttributeLDAP
ActivityType: ActivityType
Domain: Domain
EventData: EventData
tactics:
- Discovery
queryPeriod: 5h
severity: Low
status: Available
name: PROD (TM011.1) - LAPS - Tier Level Computer Object LAPS Password Expiration Time Set Manually
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/daf2b9f7-dcf2-4b45-831a-d7142318c7e9')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/daf2b9f7-dcf2-4b45-831a-d7142318c7e9')]",
"properties": {
"alertDetailsOverride": {
"alertDescriptionFormat": "The LAPS password for {{ObjectName}} was expired manually.",
"alertDisplayNameFormat": "(TM011.1) A {{ObjectTier}} LAPS password was expired by {{Account}} manually."
},
"alertRuleTemplateName": "daf2b9f7-dcf2-4b45-831a-d7142318c7e9",
"customDetails": {
"Account": "Account",
"ActivityType": "ActivityType",
"AttributeLDAP": "AttributeLDAP",
"Channel": "Channel",
"Computer": "Computer",
"Domain": "Domain",
"EventData": "EventData",
"EventID": "EventID",
"ObjectName": "ObjectName",
"ObjectTier": "ObjectTier"
},
"description": "Alert if a Tier Model computer object LAPS password was manually expired.\n",
"displayName": "PROD (TM011.1) - LAPS - Tier Level Computer Object LAPS Password Expiration Time Set Manually",
"enabled": true,
"entityMappings": [
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "ObjectName",
"identifier": "FullName"
}
]
},
{
"entityType": "Host",
"fieldMappings": [
{
"columnName": "Computer",
"identifier": "HostName"
}
]
},
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "Account",
"identifier": "FullName"
}
]
}
],
"eventGroupingSettings": {
"aggregationKind": "AlertPerResult"
},
"incidentConfiguration": {
"createIncident": true,
"groupingConfiguration": {
"enabled": false,
"lookbackDuration": "PT5H",
"matchingMethod": "AllEntities",
"reopenClosedIncident": false
}
},
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM011_LAPSTierLevelComputerObjectLAPSPasswordExpirationTimeSetManu.yaml",
"query": "SecurityEvent\n| where EventID == 5136\n and (EventData matches regex @\"(?i)OU=Domain Controllers\"\n or EventData matches regex @\"(?i)OU=Tier 0 PAW\"\n or EventData matches regex @\"(?i)OU=Tier 1 PAW\"\n or EventData matches regex @\"(?i)OU=Tier 2 PAW\"\n or EventData matches regex @\"(?i)OU=Tier 0 Member Servers\"\n or EventData matches regex @\"(?i)OU=Tier 1 Member Servers\")\n and AccountType == \"User\"\n| extend AttributeLDAP = extract(\"<Data Name=\\\"AttributeLDAPDisplayName\\\">([^<]+)</Data>\", 1, EventData)\n| where AttributeLDAP has \"msLAPS-PasswordExpirationTime\"\n| extend ObjectName_e = extract(\"<Data Name=\\\"ObjectDN\\\">([^<]+)</Data>\", 1, EventData)\n| extend ObjectName = extract(\"(?i)CN=([^,]+)\", 1, ObjectName_e)\n| extend ObjectTier = case(\n ObjectName_e has \"Tier 0\", \"Tier 0\",\n ObjectName_e has \"Tier 1\", \"Tier 1\",\n ObjectName_e has \"Tier Model Administration\", \"Tier 0\",\n ObjectName_e has \"Tier Model Computer Quarantine\", \"Tier 0\",\n ObjectName_e has \"Domain Controllers\", \"Tier 0\",\n \"Unknown\")\n| extend ActivityType = extract(\"([a-zA-Z]+)\\\\.$\", 1, Activity)\n| extend Domain = extract(\"([^.]+\\\\.[^.]+)$\", 1, Computer)\n| extend OperationType = iff(EventData has 'OperationType\">%%14674', \"Added\", tostring(OperationType))\n| project TimeGenerated\n , ObjectName\n , ObjectTier\n , AttributeLDAP\n , ActivityType\n , Account\n , Domain\n , Computer\n , Channel\n , EventID\n , EventData\n",
"queryFrequency": "PT5H",
"queryPeriod": "PT5H",
"severity": "Low",
"status": "Available",
"subTechniques": [
"T1087.001"
],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"Discovery"
],
"techniques": [
"T1087"
],
"templateVersion": "1.0.0",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}