Analytic rule catalog
PROD TM0061 - ACL - Modified at Tier Level OU
Back
| Id | f3e2433b-6456-4009-a1cb-0d4eb3a36125 |
| Rulename | PROD (TM006.1) - ACL - Modified at Tier Level OU |
| Description | ACL modification of any Tier Model OU. |
| Severity | High |
| Tactics | DefenseEvasion |
| Techniques | T1222.001 |
| Required data connectors | SecurityEvents WindowsSecurityEvents |
| Kind | Scheduled |
| Query frequency | 5m |
| Query period | 5m |
| Trigger threshold | 0 |
| Trigger operator | gt |
| Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM006_ACLModifiedAtTierLevelOU.yaml |
| Version | 1.0.0 |
| Arm template | f3e2433b-6456-4009-a1cb-0d4eb3a36125.json |
SecurityEvent
| where EventID == 5136
and (EventData matches regex @"(?i)OU=Domain Controllers"
or EventData matches regex @"(?i)OU=Tier 0 Member Servers"
or EventData matches regex @"(?i)OU=Tier 1 Member Servers"
or EventData matches regex @"(?i)OU=Tier 2 End-User Accounts"
or EventData matches regex @"(?i)OU=Tier 2 End-User Devices"
or EventData matches regex @"(?i)OU=Tier 2 End-User Groups"
or EventData matches regex @"(?i)OU=Tier Model Administration"
or EventData matches regex @"(?i)OU=Tier Model Computer Quarantine")
and Activity has "modified"
and EventData has '"ObjectClass">organizationalUnit'
and EventData has '<Data Name="AttributeLDAPDisplayName">nTSecurityDescriptor</Data>'
and EventData has '"OperationType">%%14674'
| extend ObjectName = extract("(?i)<Data Name=\"ObjectDN\">(((?i)OU=[^,]+,?)+),[dD][cC]=", 1, EventData)
| extend ObjectTier = case(
ObjectName has "Tier 0", "Tier 0",
ObjectName has "Tier 1", "Tier 1",
ObjectName has "Tier 2", "Tier 2",
ObjectName has "Tier Model Administration", "Tier 0",
ObjectName has "Tier Model Computer Quarantine", "Tier 0",
ObjectName has "Domain Controllers", "Tier 0",
"Unknown")
| extend AttributeLDAP = extract("<Data Name=\"AttributeLDAPDisplayName\">([^<]+)</Data>", 1, EventData)
| extend AttributeValue = extract("\\[([^\\]]+)\\]", 1, EventData)
| extend OperationType = iff(EventData has 'nTSecurityDescriptor', "ACL Modified", tostring(OperationType))
| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| project TimeGenerated
, ObjectName
, ObjectTier
, ObjectClass
, OperationType
, ActivityType
, AttributeLDAP
, Account
, Domain
, Computer
, Channel
, EventID
, EventData
version: 1.0.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM006_ACLModifiedAtTierLevelOU.yaml
triggerThreshold: 0
requiredDataConnectors:
- dataTypes:
- SecurityEvent
connectorId: SecurityEvents
- dataTypes:
- SecurityEvent
connectorId: WindowsSecurityEvents
tactics:
- DefenseEvasion
relevantTechniques:
- T1222.001
eventGroupingSettings:
aggregationKind: AlertPerResult
incidentConfiguration:
groupingConfiguration:
matchingMethod: AllEntities
lookbackDuration: PT5H
reopenClosedIncident: false
enabled: false
createIncident: true
alertDetailsOverride:
alertDescriptionFormat: Modification to any Tier Model OU ACL.
alertDisplayNameFormat: (TM006.1) A {{ObjectTier}} OU ACL was modified at the following {{ObjectName}} OU
entityMappings:
- fieldMappings:
- identifier: FullName
columnName: ObjectName
entityType: Account
- fieldMappings:
- identifier: HostName
columnName: Computer
entityType: Host
- fieldMappings:
- identifier: FullName
columnName: Account
entityType: Account
description: |
ACL modification of any Tier Model OU.
triggerOperator: gt
kind: Scheduled
status: Available
queryFrequency: 5m
id: f3e2433b-6456-4009-a1cb-0d4eb3a36125
name: PROD (TM006.1) - ACL - Modified at Tier Level OU
severity: High
query: |
SecurityEvent
| where EventID == 5136
and (EventData matches regex @"(?i)OU=Domain Controllers"
or EventData matches regex @"(?i)OU=Tier 0 Member Servers"
or EventData matches regex @"(?i)OU=Tier 1 Member Servers"
or EventData matches regex @"(?i)OU=Tier 2 End-User Accounts"
or EventData matches regex @"(?i)OU=Tier 2 End-User Devices"
or EventData matches regex @"(?i)OU=Tier 2 End-User Groups"
or EventData matches regex @"(?i)OU=Tier Model Administration"
or EventData matches regex @"(?i)OU=Tier Model Computer Quarantine")
and Activity has "modified"
and EventData has '"ObjectClass">organizationalUnit'
and EventData has '<Data Name="AttributeLDAPDisplayName">nTSecurityDescriptor</Data>'
and EventData has '"OperationType">%%14674'
| extend ObjectName = extract("(?i)<Data Name=\"ObjectDN\">(((?i)OU=[^,]+,?)+),[dD][cC]=", 1, EventData)
| extend ObjectTier = case(
ObjectName has "Tier 0", "Tier 0",
ObjectName has "Tier 1", "Tier 1",
ObjectName has "Tier 2", "Tier 2",
ObjectName has "Tier Model Administration", "Tier 0",
ObjectName has "Tier Model Computer Quarantine", "Tier 0",
ObjectName has "Domain Controllers", "Tier 0",
"Unknown")
| extend AttributeLDAP = extract("<Data Name=\"AttributeLDAPDisplayName\">([^<]+)</Data>", 1, EventData)
| extend AttributeValue = extract("\\[([^\\]]+)\\]", 1, EventData)
| extend OperationType = iff(EventData has 'nTSecurityDescriptor', "ACL Modified", tostring(OperationType))
| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| project TimeGenerated
, ObjectName
, ObjectTier
, ObjectClass
, OperationType
, ActivityType
, AttributeLDAP
, Account
, Domain
, Computer
, Channel
, EventID
, EventData
queryPeriod: 5m
customDetails:
ObjectName: ObjectName
Channel: Channel
Domain: Domain
ObjectTier: ObjectTier
OperationType: OperationType
EventData: EventData
ActivityType: ActivityType
AttributeLDAP: AttributeLDAP
EventID: EventID
ObjectClass: ObjectClass
Computer: Computer
Account: Account
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/f3e2433b-6456-4009-a1cb-0d4eb3a36125')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/f3e2433b-6456-4009-a1cb-0d4eb3a36125')]",
"properties": {
"alertDetailsOverride": {
"alertDescriptionFormat": "Modification to any Tier Model OU ACL.",
"alertDisplayNameFormat": "(TM006.1) A {{ObjectTier}} OU ACL was modified at the following {{ObjectName}} OU"
},
"alertRuleTemplateName": "f3e2433b-6456-4009-a1cb-0d4eb3a36125",
"customDetails": {
"Account": "Account",
"ActivityType": "ActivityType",
"AttributeLDAP": "AttributeLDAP",
"Channel": "Channel",
"Computer": "Computer",
"Domain": "Domain",
"EventData": "EventData",
"EventID": "EventID",
"ObjectClass": "ObjectClass",
"ObjectName": "ObjectName",
"ObjectTier": "ObjectTier",
"OperationType": "OperationType"
},
"description": "ACL modification of any Tier Model OU.\n",
"displayName": "PROD (TM006.1) - ACL - Modified at Tier Level OU",
"enabled": true,
"entityMappings": [
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "ObjectName",
"identifier": "FullName"
}
]
},
{
"entityType": "Host",
"fieldMappings": [
{
"columnName": "Computer",
"identifier": "HostName"
}
]
},
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "Account",
"identifier": "FullName"
}
]
}
],
"eventGroupingSettings": {
"aggregationKind": "AlertPerResult"
},
"incidentConfiguration": {
"createIncident": true,
"groupingConfiguration": {
"enabled": false,
"lookbackDuration": "PT5H",
"matchingMethod": "AllEntities",
"reopenClosedIncident": false
}
},
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM006_ACLModifiedAtTierLevelOU.yaml",
"query": "SecurityEvent \n| where EventID == 5136 \n and (EventData matches regex @\"(?i)OU=Domain Controllers\"\n or EventData matches regex @\"(?i)OU=Tier 0 Member Servers\"\n or EventData matches regex @\"(?i)OU=Tier 1 Member Servers\"\n or EventData matches regex @\"(?i)OU=Tier 2 End-User Accounts\"\n or EventData matches regex @\"(?i)OU=Tier 2 End-User Devices\"\n or EventData matches regex @\"(?i)OU=Tier 2 End-User Groups\"\n or EventData matches regex @\"(?i)OU=Tier Model Administration\"\n or EventData matches regex @\"(?i)OU=Tier Model Computer Quarantine\")\n and Activity has \"modified\" \n and EventData has '\"ObjectClass\">organizationalUnit'\n and EventData has '<Data Name=\"AttributeLDAPDisplayName\">nTSecurityDescriptor</Data>'\n and EventData has '\"OperationType\">%%14674'\n| extend ObjectName = extract(\"(?i)<Data Name=\\\"ObjectDN\\\">(((?i)OU=[^,]+,?)+),[dD][cC]=\", 1, EventData)\n| extend ObjectTier = case(\n ObjectName has \"Tier 0\", \"Tier 0\",\n ObjectName has \"Tier 1\", \"Tier 1\",\n ObjectName has \"Tier 2\", \"Tier 2\",\n ObjectName has \"Tier Model Administration\", \"Tier 0\",\n ObjectName has \"Tier Model Computer Quarantine\", \"Tier 0\",\n ObjectName has \"Domain Controllers\", \"Tier 0\",\n \"Unknown\")\n| extend AttributeLDAP = extract(\"<Data Name=\\\"AttributeLDAPDisplayName\\\">([^<]+)</Data>\", 1, EventData)\n| extend AttributeValue = extract(\"\\\\[([^\\\\]]+)\\\\]\", 1, EventData)\n| extend OperationType = iff(EventData has 'nTSecurityDescriptor', \"ACL Modified\", tostring(OperationType))\n| extend ActivityType = extract(\"([a-zA-Z]+)\\\\.$\", 1, Activity)\n| extend ObjectClass = extract(\"<Data Name=\\\"ObjectClass\\\">([^<]+)</Data>\", 1, EventData)\n| extend Domain = extract(\"([^.]+\\\\.[^.]+)$\", 1, Computer)\n| project TimeGenerated\n , ObjectName\n , ObjectTier\n , ObjectClass\n , OperationType\n , ActivityType\n , AttributeLDAP\n , Account\n , Domain\n , Computer\n , Channel\n , EventID\n , EventData\n",
"queryFrequency": "PT5M",
"queryPeriod": "PT5M",
"severity": "High",
"status": "Available",
"subTechniques": [
"T1222.001"
],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"DefenseEvasion"
],
"techniques": [
"T1222"
],
"templateVersion": "1.0.0",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}