AR Microsoft Sentinel Analytic Rules ONLINE

Analytic rule catalog

PROD TM0101 - BITLOCKER - Stored Bitlocker Recovery Key to Tier Level Computer Object

Back
Ideea9c640-afe0-4ce4-9a41-c409d4c2c924
RulenamePROD (TM010.1) - BITLOCKER - Stored Bitlocker Recovery Key to Tier Level Computer Object
DescriptionA Bitlocker recovery key was stored within a Tier Model computer object.
SeverityInformational
TacticsCredentialAccess
TechniquesT1552.004
Required data connectorsSecurityEvents
WindowsSecurityEvents
KindScheduled
Query frequency5h
Query period5h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM010_BITLOCKERStoredBitlockerRecoveryKeyToTierLevelComputerObject.yaml
Version1.0.0
Arm templateeea9c640-afe0-4ce4-9a41-c409d4c2c924.json
Deploy To Azure
SecurityEvent
| where EventID == 5137
    and (EventData matches regex @"(?i)OU=Domain Controllers"
        or EventData matches regex @"(?i)OU=Tier 0 PAW"
        or EventData matches regex @"(?i)OU=Tier 1 PAW"
        or EventData matches regex @"(?i)OU=Tier 2 PAW"
        or EventData matches regex @"(?i)OU=Tier 0 Member Servers"
        or EventData matches regex @"(?i)OU=Tier 1 Member Servers")
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
| where ObjectClass has "msFVE-RecoveryInformation"
| extend ObjectBitName_e = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
| extend ObjectFullName = extract("(?i)(CN=[^,]+,(?i)OU=[^,]+)", 1, ObjectBitName_e)
| extend ObjectName = extract("(?i)CN=([^,]+)", 1, ObjectFullName)
| extend ObjectTier = case(
    ObjectFullName has "Tier 0", "Tier 0",
    ObjectFullName has "Tier 1", "Tier 1",
    ObjectFullName has "Tier Model Administration", "Tier 0",
    ObjectFullName has "Tier Model Computer Quarantine", "Tier 0",
    ObjectFullName has "Domain Controllers", "Tier 0",
    "Unknown")
| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| project TimeGenerated
   , ObjectName
   , ObjectTier
   , ObjectClass
   , ActivityType
   , Account
   , Domain
   , Computer
   , Channel
   , EventID
   , EventData

tactics:
- CredentialAccess
name: PROD (TM010.1) - BITLOCKER - Stored Bitlocker Recovery Key to Tier Level Computer Object
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM010_BITLOCKERStoredBitlockerRecoveryKeyToTierLevelComputerObject.yaml
version: 1.0.0
queryFrequency: 5h
requiredDataConnectors:
- connectorId: SecurityEvents
  dataTypes:
  - SecurityEvent
- connectorId: WindowsSecurityEvents
  dataTypes:
  - SecurityEvent
customDetails:
  EventData: EventData
  Computer: Computer
  ActivityType: ActivityType
  ObjectClass: ObjectClass
  EventID: EventID
  ObjectTier: ObjectTier
  ObjectName: ObjectName
  Domain: Domain
  Account: Account
  Channel: Channel
id: eea9c640-afe0-4ce4-9a41-c409d4c2c924
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: ObjectName
  entityType: Account
- fieldMappings:
  - identifier: HostName
    columnName: Computer
  entityType: Host
- fieldMappings:
  - identifier: FullName
    columnName: Account
  entityType: Account
queryPeriod: 5h
alertDetailsOverride:
  alertDescriptionFormat: A Tier Model object Bitlocker Key was stored in AD. This Informational alert is generated as part of reporting.
  alertDisplayNameFormat: (TM010.1) A {{ObjectTier}} Bitlocker Recovery Key was stored in AD
severity: Informational
relevantTechniques:
- T1552.004
eventGroupingSettings:
  aggregationKind: AlertPerResult
description: |
  A Bitlocker recovery key was stored within a Tier Model computer object.
triggerOperator: gt
status: Available
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    reopenClosedIncident: false
    enabled: false
    matchingMethod: AllEntities
    lookbackDuration: PT5H
kind: Scheduled
query: |
  SecurityEvent
  | where EventID == 5137
      and (EventData matches regex @"(?i)OU=Domain Controllers"
          or EventData matches regex @"(?i)OU=Tier 0 PAW"
          or EventData matches regex @"(?i)OU=Tier 1 PAW"
          or EventData matches regex @"(?i)OU=Tier 2 PAW"
          or EventData matches regex @"(?i)OU=Tier 0 Member Servers"
          or EventData matches regex @"(?i)OU=Tier 1 Member Servers")
  | extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
  | where ObjectClass has "msFVE-RecoveryInformation"
  | extend ObjectBitName_e = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
  | extend ObjectFullName = extract("(?i)(CN=[^,]+,(?i)OU=[^,]+)", 1, ObjectBitName_e)
  | extend ObjectName = extract("(?i)CN=([^,]+)", 1, ObjectFullName)
  | extend ObjectTier = case(
      ObjectFullName has "Tier 0", "Tier 0",
      ObjectFullName has "Tier 1", "Tier 1",
      ObjectFullName has "Tier Model Administration", "Tier 0",
      ObjectFullName has "Tier Model Computer Quarantine", "Tier 0",
      ObjectFullName has "Domain Controllers", "Tier 0",
      "Unknown")
  | extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
  | extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
  | project TimeGenerated
     , ObjectName
     , ObjectTier
     , ObjectClass
     , ActivityType
     , Account
     , Domain
     , Computer
     , Channel
     , EventID
     , EventData

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/eea9c640-afe0-4ce4-9a41-c409d4c2c924')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/eea9c640-afe0-4ce4-9a41-c409d4c2c924')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "A Tier Model object Bitlocker Key was stored in AD. This Informational alert is generated as part of reporting.",
          "alertDisplayNameFormat": "(TM010.1) A {{ObjectTier}} Bitlocker Recovery Key was stored in AD"
        },
        "alertRuleTemplateName": "eea9c640-afe0-4ce4-9a41-c409d4c2c924",
        "customDetails": {
          "Account": "Account",
          "ActivityType": "ActivityType",
          "Channel": "Channel",
          "Computer": "Computer",
          "Domain": "Domain",
          "EventData": "EventData",
          "EventID": "EventID",
          "ObjectClass": "ObjectClass",
          "ObjectName": "ObjectName",
          "ObjectTier": "ObjectTier"
        },
        "description": "A Bitlocker recovery key was stored within a Tier Model computer object.\n",
        "displayName": "PROD (TM010.1) - BITLOCKER - Stored Bitlocker Recovery Key to Tier Level Computer Object",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "ObjectName",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "Computer",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "Account",
                "identifier": "FullName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM010_BITLOCKERStoredBitlockerRecoveryKeyToTierLevelComputerObject.yaml",
        "query": "SecurityEvent\n| where EventID == 5137\n    and (EventData matches regex @\"(?i)OU=Domain Controllers\"\n        or EventData matches regex @\"(?i)OU=Tier 0 PAW\"\n        or EventData matches regex @\"(?i)OU=Tier 1 PAW\"\n        or EventData matches regex @\"(?i)OU=Tier 2 PAW\"\n        or EventData matches regex @\"(?i)OU=Tier 0 Member Servers\"\n        or EventData matches regex @\"(?i)OU=Tier 1 Member Servers\")\n| extend ObjectClass = extract(\"<Data Name=\\\"ObjectClass\\\">([^<]+)</Data>\", 1, EventData)\n| where ObjectClass has \"msFVE-RecoveryInformation\"\n| extend ObjectBitName_e = extract(\"<Data Name=\\\"ObjectDN\\\">([^<]+)</Data>\", 1, EventData)\n| extend ObjectFullName = extract(\"(?i)(CN=[^,]+,(?i)OU=[^,]+)\", 1, ObjectBitName_e)\n| extend ObjectName = extract(\"(?i)CN=([^,]+)\", 1, ObjectFullName)\n| extend ObjectTier = case(\n    ObjectFullName has \"Tier 0\", \"Tier 0\",\n    ObjectFullName has \"Tier 1\", \"Tier 1\",\n    ObjectFullName has \"Tier Model Administration\", \"Tier 0\",\n    ObjectFullName has \"Tier Model Computer Quarantine\", \"Tier 0\",\n    ObjectFullName has \"Domain Controllers\", \"Tier 0\",\n    \"Unknown\")\n| extend ActivityType = extract(\"([a-zA-Z]+)\\\\.$\", 1, Activity)\n| extend Domain = extract(\"([^.]+\\\\.[^.]+)$\", 1, Computer)\n| project TimeGenerated\n   , ObjectName\n   , ObjectTier\n   , ObjectClass\n   , ActivityType\n   , Account\n   , Domain\n   , Computer\n   , Channel\n   , EventID\n   , EventData\n",
        "queryFrequency": "PT5H",
        "queryPeriod": "PT5H",
        "severity": "Informational",
        "status": "Available",
        "subTechniques": [
          "T1552.004"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess"
        ],
        "techniques": [
          "T1552"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}