Analytic rule catalog
PROD TM0101 - BITLOCKER - Stored Bitlocker Recovery Key to Tier Level Computer Object
Back
| Id | eea9c640-afe0-4ce4-9a41-c409d4c2c924 |
| Rulename | PROD (TM010.1) - BITLOCKER - Stored Bitlocker Recovery Key to Tier Level Computer Object |
| Description | A Bitlocker recovery key was stored within a Tier Model computer object. |
| Severity | Informational |
| Tactics | CredentialAccess |
| Techniques | T1552.004 |
| Required data connectors | SecurityEvents WindowsSecurityEvents |
| Kind | Scheduled |
| Query frequency | 5h |
| Query period | 5h |
| Trigger threshold | 0 |
| Trigger operator | gt |
| Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM010_BITLOCKERStoredBitlockerRecoveryKeyToTierLevelComputerObject.yaml |
| Version | 1.0.0 |
| Arm template | eea9c640-afe0-4ce4-9a41-c409d4c2c924.json |
SecurityEvent
| where EventID == 5137
and (EventData matches regex @"(?i)OU=Domain Controllers"
or EventData matches regex @"(?i)OU=Tier 0 PAW"
or EventData matches regex @"(?i)OU=Tier 1 PAW"
or EventData matches regex @"(?i)OU=Tier 2 PAW"
or EventData matches regex @"(?i)OU=Tier 0 Member Servers"
or EventData matches regex @"(?i)OU=Tier 1 Member Servers")
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
| where ObjectClass has "msFVE-RecoveryInformation"
| extend ObjectBitName_e = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
| extend ObjectFullName = extract("(?i)(CN=[^,]+,(?i)OU=[^,]+)", 1, ObjectBitName_e)
| extend ObjectName = extract("(?i)CN=([^,]+)", 1, ObjectFullName)
| extend ObjectTier = case(
ObjectFullName has "Tier 0", "Tier 0",
ObjectFullName has "Tier 1", "Tier 1",
ObjectFullName has "Tier Model Administration", "Tier 0",
ObjectFullName has "Tier Model Computer Quarantine", "Tier 0",
ObjectFullName has "Domain Controllers", "Tier 0",
"Unknown")
| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| project TimeGenerated
, ObjectName
, ObjectTier
, ObjectClass
, ActivityType
, Account
, Domain
, Computer
, Channel
, EventID
, EventData
severity: Informational
tactics:
- CredentialAccess
queryFrequency: 5h
id: eea9c640-afe0-4ce4-9a41-c409d4c2c924
query: |
SecurityEvent
| where EventID == 5137
and (EventData matches regex @"(?i)OU=Domain Controllers"
or EventData matches regex @"(?i)OU=Tier 0 PAW"
or EventData matches regex @"(?i)OU=Tier 1 PAW"
or EventData matches regex @"(?i)OU=Tier 2 PAW"
or EventData matches regex @"(?i)OU=Tier 0 Member Servers"
or EventData matches regex @"(?i)OU=Tier 1 Member Servers")
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
| where ObjectClass has "msFVE-RecoveryInformation"
| extend ObjectBitName_e = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
| extend ObjectFullName = extract("(?i)(CN=[^,]+,(?i)OU=[^,]+)", 1, ObjectBitName_e)
| extend ObjectName = extract("(?i)CN=([^,]+)", 1, ObjectFullName)
| extend ObjectTier = case(
ObjectFullName has "Tier 0", "Tier 0",
ObjectFullName has "Tier 1", "Tier 1",
ObjectFullName has "Tier Model Administration", "Tier 0",
ObjectFullName has "Tier Model Computer Quarantine", "Tier 0",
ObjectFullName has "Domain Controllers", "Tier 0",
"Unknown")
| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| project TimeGenerated
, ObjectName
, ObjectTier
, ObjectClass
, ActivityType
, Account
, Domain
, Computer
, Channel
, EventID
, EventData
entityMappings:
- fieldMappings:
- identifier: FullName
columnName: ObjectName
entityType: Account
- fieldMappings:
- identifier: HostName
columnName: Computer
entityType: Host
- fieldMappings:
- identifier: FullName
columnName: Account
entityType: Account
incidentConfiguration:
groupingConfiguration:
lookbackDuration: PT5H
matchingMethod: AllEntities
reopenClosedIncident: false
enabled: false
createIncident: true
customDetails:
ObjectName: ObjectName
Account: Account
EventID: EventID
Domain: Domain
ObjectClass: ObjectClass
ObjectTier: ObjectTier
Channel: Channel
ActivityType: ActivityType
EventData: EventData
Computer: Computer
kind: Scheduled
triggerOperator: gt
name: PROD (TM010.1) - BITLOCKER - Stored Bitlocker Recovery Key to Tier Level Computer Object
version: 1.0.0
status: Available
requiredDataConnectors:
- dataTypes:
- SecurityEvent
connectorId: SecurityEvents
- dataTypes:
- SecurityEvent
connectorId: WindowsSecurityEvents
description: |
A Bitlocker recovery key was stored within a Tier Model computer object.
relevantTechniques:
- T1552.004
queryPeriod: 5h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM010_BITLOCKERStoredBitlockerRecoveryKeyToTierLevelComputerObject.yaml
triggerThreshold: 0
eventGroupingSettings:
aggregationKind: AlertPerResult
alertDetailsOverride:
alertDisplayNameFormat: (TM010.1) A {{ObjectTier}} Bitlocker Recovery Key was stored in AD
alertDescriptionFormat: A Tier Model object Bitlocker Key was stored in AD. This Informational alert is generated as part of reporting.
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/eea9c640-afe0-4ce4-9a41-c409d4c2c924')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/eea9c640-afe0-4ce4-9a41-c409d4c2c924')]",
"properties": {
"alertDetailsOverride": {
"alertDescriptionFormat": "A Tier Model object Bitlocker Key was stored in AD. This Informational alert is generated as part of reporting.",
"alertDisplayNameFormat": "(TM010.1) A {{ObjectTier}} Bitlocker Recovery Key was stored in AD"
},
"alertRuleTemplateName": "eea9c640-afe0-4ce4-9a41-c409d4c2c924",
"customDetails": {
"Account": "Account",
"ActivityType": "ActivityType",
"Channel": "Channel",
"Computer": "Computer",
"Domain": "Domain",
"EventData": "EventData",
"EventID": "EventID",
"ObjectClass": "ObjectClass",
"ObjectName": "ObjectName",
"ObjectTier": "ObjectTier"
},
"description": "A Bitlocker recovery key was stored within a Tier Model computer object.\n",
"displayName": "PROD (TM010.1) - BITLOCKER - Stored Bitlocker Recovery Key to Tier Level Computer Object",
"enabled": true,
"entityMappings": [
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "ObjectName",
"identifier": "FullName"
}
]
},
{
"entityType": "Host",
"fieldMappings": [
{
"columnName": "Computer",
"identifier": "HostName"
}
]
},
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "Account",
"identifier": "FullName"
}
]
}
],
"eventGroupingSettings": {
"aggregationKind": "AlertPerResult"
},
"incidentConfiguration": {
"createIncident": true,
"groupingConfiguration": {
"enabled": false,
"lookbackDuration": "PT5H",
"matchingMethod": "AllEntities",
"reopenClosedIncident": false
}
},
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM010_BITLOCKERStoredBitlockerRecoveryKeyToTierLevelComputerObject.yaml",
"query": "SecurityEvent\n| where EventID == 5137\n and (EventData matches regex @\"(?i)OU=Domain Controllers\"\n or EventData matches regex @\"(?i)OU=Tier 0 PAW\"\n or EventData matches regex @\"(?i)OU=Tier 1 PAW\"\n or EventData matches regex @\"(?i)OU=Tier 2 PAW\"\n or EventData matches regex @\"(?i)OU=Tier 0 Member Servers\"\n or EventData matches regex @\"(?i)OU=Tier 1 Member Servers\")\n| extend ObjectClass = extract(\"<Data Name=\\\"ObjectClass\\\">([^<]+)</Data>\", 1, EventData)\n| where ObjectClass has \"msFVE-RecoveryInformation\"\n| extend ObjectBitName_e = extract(\"<Data Name=\\\"ObjectDN\\\">([^<]+)</Data>\", 1, EventData)\n| extend ObjectFullName = extract(\"(?i)(CN=[^,]+,(?i)OU=[^,]+)\", 1, ObjectBitName_e)\n| extend ObjectName = extract(\"(?i)CN=([^,]+)\", 1, ObjectFullName)\n| extend ObjectTier = case(\n ObjectFullName has \"Tier 0\", \"Tier 0\",\n ObjectFullName has \"Tier 1\", \"Tier 1\",\n ObjectFullName has \"Tier Model Administration\", \"Tier 0\",\n ObjectFullName has \"Tier Model Computer Quarantine\", \"Tier 0\",\n ObjectFullName has \"Domain Controllers\", \"Tier 0\",\n \"Unknown\")\n| extend ActivityType = extract(\"([a-zA-Z]+)\\\\.$\", 1, Activity)\n| extend Domain = extract(\"([^.]+\\\\.[^.]+)$\", 1, Computer)\n| project TimeGenerated\n , ObjectName\n , ObjectTier\n , ObjectClass\n , ActivityType\n , Account\n , Domain\n , Computer\n , Channel\n , EventID\n , EventData\n",
"queryFrequency": "PT5H",
"queryPeriod": "PT5H",
"severity": "Informational",
"status": "Available",
"subTechniques": [
"T1552.004"
],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"CredentialAccess"
],
"techniques": [
"T1552"
],
"templateVersion": "1.0.0",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}