Analytic rule catalog
PROD TM0061 - ACL - Modified at Tier Level OU
Back
| Id | f3e2433b-6456-4009-a1cb-0d4eb3a36125 |
| Rulename | PROD (TM006.1) - ACL - Modified at Tier Level OU |
| Description | ACL modification of any Tier Model OU. |
| Severity | High |
| Tactics | DefenseEvasion |
| Techniques | T1222.001 |
| Required data connectors | SecurityEvents WindowsSecurityEvents |
| Kind | Scheduled |
| Query frequency | 5m |
| Query period | 5m |
| Trigger threshold | 0 |
| Trigger operator | gt |
| Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM006_ACLModifiedAtTierLevelOU.yaml |
| Version | 1.0.0 |
| Arm template | f3e2433b-6456-4009-a1cb-0d4eb3a36125.json |
SecurityEvent
| where EventID == 5136
and (EventData matches regex @"(?i)OU=Domain Controllers"
or EventData matches regex @"(?i)OU=Tier 0 Member Servers"
or EventData matches regex @"(?i)OU=Tier 1 Member Servers"
or EventData matches regex @"(?i)OU=Tier 2 End-User Accounts"
or EventData matches regex @"(?i)OU=Tier 2 End-User Devices"
or EventData matches regex @"(?i)OU=Tier 2 End-User Groups"
or EventData matches regex @"(?i)OU=Tier Model Administration"
or EventData matches regex @"(?i)OU=Tier Model Computer Quarantine")
and Activity has "modified"
and EventData has '"ObjectClass">organizationalUnit'
and EventData has '<Data Name="AttributeLDAPDisplayName">nTSecurityDescriptor</Data>'
and EventData has '"OperationType">%%14674'
| extend ObjectName = extract("(?i)<Data Name=\"ObjectDN\">(((?i)OU=[^,]+,?)+),[dD][cC]=", 1, EventData)
| extend ObjectTier = case(
ObjectName has "Tier 0", "Tier 0",
ObjectName has "Tier 1", "Tier 1",
ObjectName has "Tier 2", "Tier 2",
ObjectName has "Tier Model Administration", "Tier 0",
ObjectName has "Tier Model Computer Quarantine", "Tier 0",
ObjectName has "Domain Controllers", "Tier 0",
"Unknown")
| extend AttributeLDAP = extract("<Data Name=\"AttributeLDAPDisplayName\">([^<]+)</Data>", 1, EventData)
| extend AttributeValue = extract("\\[([^\\]]+)\\]", 1, EventData)
| extend OperationType = iff(EventData has 'nTSecurityDescriptor', "ACL Modified", tostring(OperationType))
| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| project TimeGenerated
, ObjectName
, ObjectTier
, ObjectClass
, OperationType
, ActivityType
, AttributeLDAP
, Account
, Domain
, Computer
, Channel
, EventID
, EventData
incidentConfiguration:
groupingConfiguration:
lookbackDuration: PT5H
reopenClosedIncident: false
matchingMethod: AllEntities
enabled: false
createIncident: true
name: PROD (TM006.1) - ACL - Modified at Tier Level OU
triggerOperator: gt
query: |
SecurityEvent
| where EventID == 5136
and (EventData matches regex @"(?i)OU=Domain Controllers"
or EventData matches regex @"(?i)OU=Tier 0 Member Servers"
or EventData matches regex @"(?i)OU=Tier 1 Member Servers"
or EventData matches regex @"(?i)OU=Tier 2 End-User Accounts"
or EventData matches regex @"(?i)OU=Tier 2 End-User Devices"
or EventData matches regex @"(?i)OU=Tier 2 End-User Groups"
or EventData matches regex @"(?i)OU=Tier Model Administration"
or EventData matches regex @"(?i)OU=Tier Model Computer Quarantine")
and Activity has "modified"
and EventData has '"ObjectClass">organizationalUnit'
and EventData has '<Data Name="AttributeLDAPDisplayName">nTSecurityDescriptor</Data>'
and EventData has '"OperationType">%%14674'
| extend ObjectName = extract("(?i)<Data Name=\"ObjectDN\">(((?i)OU=[^,]+,?)+),[dD][cC]=", 1, EventData)
| extend ObjectTier = case(
ObjectName has "Tier 0", "Tier 0",
ObjectName has "Tier 1", "Tier 1",
ObjectName has "Tier 2", "Tier 2",
ObjectName has "Tier Model Administration", "Tier 0",
ObjectName has "Tier Model Computer Quarantine", "Tier 0",
ObjectName has "Domain Controllers", "Tier 0",
"Unknown")
| extend AttributeLDAP = extract("<Data Name=\"AttributeLDAPDisplayName\">([^<]+)</Data>", 1, EventData)
| extend AttributeValue = extract("\\[([^\\]]+)\\]", 1, EventData)
| extend OperationType = iff(EventData has 'nTSecurityDescriptor', "ACL Modified", tostring(OperationType))
| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| project TimeGenerated
, ObjectName
, ObjectTier
, ObjectClass
, OperationType
, ActivityType
, AttributeLDAP
, Account
, Domain
, Computer
, Channel
, EventID
, EventData
queryFrequency: 5m
description: |
ACL modification of any Tier Model OU.
id: f3e2433b-6456-4009-a1cb-0d4eb3a36125
triggerThreshold: 0
queryPeriod: 5m
version: 1.0.0
kind: Scheduled
customDetails:
ObjectTier: ObjectTier
Computer: Computer
EventID: EventID
OperationType: OperationType
AttributeLDAP: AttributeLDAP
ObjectClass: ObjectClass
EventData: EventData
Account: Account
ObjectName: ObjectName
Domain: Domain
Channel: Channel
ActivityType: ActivityType
status: Available
eventGroupingSettings:
aggregationKind: AlertPerResult
severity: High
requiredDataConnectors:
- connectorId: SecurityEvents
dataTypes:
- SecurityEvent
- connectorId: WindowsSecurityEvents
dataTypes:
- SecurityEvent
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM006_ACLModifiedAtTierLevelOU.yaml
alertDetailsOverride:
alertDescriptionFormat: Modification to any Tier Model OU ACL.
alertDisplayNameFormat: (TM006.1) A {{ObjectTier}} OU ACL was modified at the following {{ObjectName}} OU
relevantTechniques:
- T1222.001
tactics:
- DefenseEvasion
entityMappings:
- fieldMappings:
- identifier: FullName
columnName: ObjectName
entityType: Account
- fieldMappings:
- identifier: HostName
columnName: Computer
entityType: Host
- fieldMappings:
- identifier: FullName
columnName: Account
entityType: Account
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/f3e2433b-6456-4009-a1cb-0d4eb3a36125')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/f3e2433b-6456-4009-a1cb-0d4eb3a36125')]",
"properties": {
"alertDetailsOverride": {
"alertDescriptionFormat": "Modification to any Tier Model OU ACL.",
"alertDisplayNameFormat": "(TM006.1) A {{ObjectTier}} OU ACL was modified at the following {{ObjectName}} OU"
},
"alertRuleTemplateName": "f3e2433b-6456-4009-a1cb-0d4eb3a36125",
"customDetails": {
"Account": "Account",
"ActivityType": "ActivityType",
"AttributeLDAP": "AttributeLDAP",
"Channel": "Channel",
"Computer": "Computer",
"Domain": "Domain",
"EventData": "EventData",
"EventID": "EventID",
"ObjectClass": "ObjectClass",
"ObjectName": "ObjectName",
"ObjectTier": "ObjectTier",
"OperationType": "OperationType"
},
"description": "ACL modification of any Tier Model OU.\n",
"displayName": "PROD (TM006.1) - ACL - Modified at Tier Level OU",
"enabled": true,
"entityMappings": [
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "ObjectName",
"identifier": "FullName"
}
]
},
{
"entityType": "Host",
"fieldMappings": [
{
"columnName": "Computer",
"identifier": "HostName"
}
]
},
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "Account",
"identifier": "FullName"
}
]
}
],
"eventGroupingSettings": {
"aggregationKind": "AlertPerResult"
},
"incidentConfiguration": {
"createIncident": true,
"groupingConfiguration": {
"enabled": false,
"lookbackDuration": "PT5H",
"matchingMethod": "AllEntities",
"reopenClosedIncident": false
}
},
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM006_ACLModifiedAtTierLevelOU.yaml",
"query": "SecurityEvent \n| where EventID == 5136 \n and (EventData matches regex @\"(?i)OU=Domain Controllers\"\n or EventData matches regex @\"(?i)OU=Tier 0 Member Servers\"\n or EventData matches regex @\"(?i)OU=Tier 1 Member Servers\"\n or EventData matches regex @\"(?i)OU=Tier 2 End-User Accounts\"\n or EventData matches regex @\"(?i)OU=Tier 2 End-User Devices\"\n or EventData matches regex @\"(?i)OU=Tier 2 End-User Groups\"\n or EventData matches regex @\"(?i)OU=Tier Model Administration\"\n or EventData matches regex @\"(?i)OU=Tier Model Computer Quarantine\")\n and Activity has \"modified\" \n and EventData has '\"ObjectClass\">organizationalUnit'\n and EventData has '<Data Name=\"AttributeLDAPDisplayName\">nTSecurityDescriptor</Data>'\n and EventData has '\"OperationType\">%%14674'\n| extend ObjectName = extract(\"(?i)<Data Name=\\\"ObjectDN\\\">(((?i)OU=[^,]+,?)+),[dD][cC]=\", 1, EventData)\n| extend ObjectTier = case(\n ObjectName has \"Tier 0\", \"Tier 0\",\n ObjectName has \"Tier 1\", \"Tier 1\",\n ObjectName has \"Tier 2\", \"Tier 2\",\n ObjectName has \"Tier Model Administration\", \"Tier 0\",\n ObjectName has \"Tier Model Computer Quarantine\", \"Tier 0\",\n ObjectName has \"Domain Controllers\", \"Tier 0\",\n \"Unknown\")\n| extend AttributeLDAP = extract(\"<Data Name=\\\"AttributeLDAPDisplayName\\\">([^<]+)</Data>\", 1, EventData)\n| extend AttributeValue = extract(\"\\\\[([^\\\\]]+)\\\\]\", 1, EventData)\n| extend OperationType = iff(EventData has 'nTSecurityDescriptor', \"ACL Modified\", tostring(OperationType))\n| extend ActivityType = extract(\"([a-zA-Z]+)\\\\.$\", 1, Activity)\n| extend ObjectClass = extract(\"<Data Name=\\\"ObjectClass\\\">([^<]+)</Data>\", 1, EventData)\n| extend Domain = extract(\"([^.]+\\\\.[^.]+)$\", 1, Computer)\n| project TimeGenerated\n , ObjectName\n , ObjectTier\n , ObjectClass\n , OperationType\n , ActivityType\n , AttributeLDAP\n , Account\n , Domain\n , Computer\n , Channel\n , EventID\n , EventData\n",
"queryFrequency": "PT5M",
"queryPeriod": "PT5M",
"severity": "High",
"status": "Available",
"subTechniques": [
"T1222.001"
],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"DefenseEvasion"
],
"techniques": [
"T1222"
],
"templateVersion": "1.0.0",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}