Analytic rule catalog
PROD TM0081 - GPO - Linked Unlinked or Enforced at Root of Domain
Back
| Id | fe468726-b1dc-4e76-adad-3480de4a2c56 |
| Rulename | PROD (TM008.1) - GPO - Linked, Unlinked, or Enforced at Root of Domain |
| Description | Linked, Unlinked, or Enforced GPOs at the Root of the Domain which could overwrite Tier Model GPOs. |
| Severity | High |
| Tactics | DefenseEvasion |
| Techniques | T1484.001 |
| Required data connectors | SecurityEvents WindowsSecurityEvents |
| Kind | Scheduled |
| Query frequency | 5m |
| Query period | 5m |
| Trigger threshold | 0 |
| Trigger operator | gt |
| Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM008_GPOLinkedUnlinkedOrEnforcedAtRootOfDomain.yaml |
| Version | 1.0.0 |
| Arm template | fe468726-b1dc-4e76-adad-3480de4a2c56.json |
SecurityEvent
| where EventID == 5136
and EventData matches regex @"(?i)DC="
and Activity has "modified"
and EventData has '"ObjectClass">domainDNS'
and EventData has '<Data Name="AttributeLDAPDisplayName">gPLink</Data>'
and (EventData has ';0]'
or EventData has ';1]'
or EventData has ';2]')
and EventData has '"OperationType">%%14674'
| extend ObjectName = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
| where ObjectName startswith "DC=" or ObjectName startswith "dc="
| extend ObjectTier = "Tier 0"
| extend AttributeLDAP = extract("<Data Name=\"AttributeLDAPDisplayName\">([^<]+)</Data>", 1, EventData)
| extend AttributeValue = extract("\\[([^\\]]+)\\]", 1, EventData)
| extend LastThreeChars = substring(AttributeValue, strlen(AttributeValue) - 2, 3)
| extend AttributeValueDescription = case(
LastThreeChars == ";0", "Linked",
LastThreeChars == ";1", "Unlinked",
LastThreeChars == ";2", "Enforced",
"Unknown")
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| project TimeGenerated
, ObjectName
, ObjectTier
, ObjectClass
, ActivityType = AttributeValueDescription
, AttributeLDAP
, Account
, Domain
, Computer
, Channel
, EventID
, EventData
incidentConfiguration:
groupingConfiguration:
lookbackDuration: PT5H
reopenClosedIncident: false
matchingMethod: AllEntities
enabled: false
createIncident: true
name: PROD (TM008.1) - GPO - Linked, Unlinked, or Enforced at Root of Domain
triggerOperator: gt
query: |
SecurityEvent
| where EventID == 5136
and EventData matches regex @"(?i)DC="
and Activity has "modified"
and EventData has '"ObjectClass">domainDNS'
and EventData has '<Data Name="AttributeLDAPDisplayName">gPLink</Data>'
and (EventData has ';0]'
or EventData has ';1]'
or EventData has ';2]')
and EventData has '"OperationType">%%14674'
| extend ObjectName = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
| where ObjectName startswith "DC=" or ObjectName startswith "dc="
| extend ObjectTier = "Tier 0"
| extend AttributeLDAP = extract("<Data Name=\"AttributeLDAPDisplayName\">([^<]+)</Data>", 1, EventData)
| extend AttributeValue = extract("\\[([^\\]]+)\\]", 1, EventData)
| extend LastThreeChars = substring(AttributeValue, strlen(AttributeValue) - 2, 3)
| extend AttributeValueDescription = case(
LastThreeChars == ";0", "Linked",
LastThreeChars == ";1", "Unlinked",
LastThreeChars == ";2", "Enforced",
"Unknown")
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| project TimeGenerated
, ObjectName
, ObjectTier
, ObjectClass
, ActivityType = AttributeValueDescription
, AttributeLDAP
, Account
, Domain
, Computer
, Channel
, EventID
, EventData
queryFrequency: 5m
description: |
Linked, Unlinked, or Enforced GPOs at the Root of the Domain which could overwrite Tier Model GPOs.
id: fe468726-b1dc-4e76-adad-3480de4a2c56
triggerThreshold: 0
queryPeriod: 5m
version: 1.0.0
kind: Scheduled
customDetails:
Account: Account
ObjectName: ObjectName
Domain: Domain
Channel: Channel
ActivityType: ActivityType
EventData: EventData
ObjectClass: ObjectClass
ObjectTier: ObjectTier
EventID: EventID
AttributeLDAP: AttributeLDAP
Computer: Computer
status: Available
eventGroupingSettings:
aggregationKind: AlertPerResult
severity: High
requiredDataConnectors:
- connectorId: SecurityEvents
dataTypes:
- SecurityEvent
- connectorId: WindowsSecurityEvents
dataTypes:
- SecurityEvent
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM008_GPOLinkedUnlinkedOrEnforcedAtRootOfDomain.yaml
alertDetailsOverride:
alertDescriptionFormat: Changes to the Root of the Domain GPO could impact the Tier Model GPOs and other security controls.
alertDisplayNameFormat: (TM008.1) A Tier 0 GPO was {{ActivityType}} at the Root of the Domain
relevantTechniques:
- T1484.001
tactics:
- DefenseEvasion
entityMappings:
- fieldMappings:
- identifier: FullName
columnName: ObjectName
entityType: Account
- fieldMappings:
- identifier: HostName
columnName: Computer
entityType: Host
- fieldMappings:
- identifier: FullName
columnName: Account
entityType: Account
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/fe468726-b1dc-4e76-adad-3480de4a2c56')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/fe468726-b1dc-4e76-adad-3480de4a2c56')]",
"properties": {
"alertDetailsOverride": {
"alertDescriptionFormat": "Changes to the Root of the Domain GPO could impact the Tier Model GPOs and other security controls.",
"alertDisplayNameFormat": "(TM008.1) A Tier 0 GPO was {{ActivityType}} at the Root of the Domain"
},
"alertRuleTemplateName": "fe468726-b1dc-4e76-adad-3480de4a2c56",
"customDetails": {
"Account": "Account",
"ActivityType": "ActivityType",
"AttributeLDAP": "AttributeLDAP",
"Channel": "Channel",
"Computer": "Computer",
"Domain": "Domain",
"EventData": "EventData",
"EventID": "EventID",
"ObjectClass": "ObjectClass",
"ObjectName": "ObjectName",
"ObjectTier": "ObjectTier"
},
"description": "Linked, Unlinked, or Enforced GPOs at the Root of the Domain which could overwrite Tier Model GPOs.\n",
"displayName": "PROD (TM008.1) - GPO - Linked, Unlinked, or Enforced at Root of Domain",
"enabled": true,
"entityMappings": [
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "ObjectName",
"identifier": "FullName"
}
]
},
{
"entityType": "Host",
"fieldMappings": [
{
"columnName": "Computer",
"identifier": "HostName"
}
]
},
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "Account",
"identifier": "FullName"
}
]
}
],
"eventGroupingSettings": {
"aggregationKind": "AlertPerResult"
},
"incidentConfiguration": {
"createIncident": true,
"groupingConfiguration": {
"enabled": false,
"lookbackDuration": "PT5H",
"matchingMethod": "AllEntities",
"reopenClosedIncident": false
}
},
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/Analytic%20Rules/TM008_GPOLinkedUnlinkedOrEnforcedAtRootOfDomain.yaml",
"query": "SecurityEvent \n| where EventID == 5136 \n and EventData matches regex @\"(?i)DC=\"\n and Activity has \"modified\" \n and EventData has '\"ObjectClass\">domainDNS'\n and EventData has '<Data Name=\"AttributeLDAPDisplayName\">gPLink</Data>' \n and (EventData has ';0]' \n or EventData has ';1]' \n or EventData has ';2]')\n and EventData has '\"OperationType\">%%14674'\n| extend ObjectName = extract(\"<Data Name=\\\"ObjectDN\\\">([^<]+)</Data>\", 1, EventData)\n| where ObjectName startswith \"DC=\" or ObjectName startswith \"dc=\"\n| extend ObjectTier = \"Tier 0\"\n| extend AttributeLDAP = extract(\"<Data Name=\\\"AttributeLDAPDisplayName\\\">([^<]+)</Data>\", 1, EventData)\n| extend AttributeValue = extract(\"\\\\[([^\\\\]]+)\\\\]\", 1, EventData)\n| extend LastThreeChars = substring(AttributeValue, strlen(AttributeValue) - 2, 3)\n| extend AttributeValueDescription = case(\n LastThreeChars == \";0\", \"Linked\",\n LastThreeChars == \";1\", \"Unlinked\",\n LastThreeChars == \";2\", \"Enforced\",\n \"Unknown\")\n| extend ObjectClass = extract(\"<Data Name=\\\"ObjectClass\\\">([^<]+)</Data>\", 1, EventData)\n| extend Domain = extract(\"([^.]+\\\\.[^.]+)$\", 1, Computer)\n| project TimeGenerated\n , ObjectName\n , ObjectTier\n , ObjectClass\n , ActivityType = AttributeValueDescription\n , AttributeLDAP\n , Account\n , Domain\n , Computer\n , Channel\n , EventID\n , EventData\n",
"queryFrequency": "PT5M",
"queryPeriod": "PT5M",
"severity": "High",
"status": "Available",
"subTechniques": [
"T1484.001"
],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"DefenseEvasion"
],
"techniques": [
"T1484"
],
"templateVersion": "1.0.0",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}