Nasreddine Bencherchali
598d29f811
chore: change tags, date, modified fields to comply with v2 of the Sigma spec. chore: update the related type from `obsoletes` to `obsolete`. chore: update local json schema to the latest version.
44 lines
2.4 KiB
YAML
44 lines
2.4 KiB
YAML
title: Potential AD User Enumeration From Non-Machine Account
|
|
id: ab6bffca-beff-4baa-af11-6733f296d57a
|
|
status: test
|
|
description: Detects read access to a domain user from a non-machine account
|
|
references:
|
|
- https://www.specterops.io/assets/resources/an_ace_up_the_sleeve.pdf
|
|
- http://www.stuffithoughtiknew.com/2019/02/detecting-bloodhound.html
|
|
- https://learn.microsoft.com/en-us/windows/win32/adschema/attributes-all # For further investigation of the accessed properties
|
|
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4662
|
|
author: Maxime Thiebaut (@0xThiebaut)
|
|
date: 2020-03-30
|
|
modified: 2022-11-08
|
|
tags:
|
|
- attack.discovery
|
|
- attack.t1087.002
|
|
logsource:
|
|
product: windows
|
|
service: security
|
|
definition: 'Requirements: The "Read all properties" permission on the user object needs to be audited for the "Everyone" principal'
|
|
detection:
|
|
selection:
|
|
EventID: 4662
|
|
# Using contains as the data commonly is structured as "%{bf967aba-0de6-11d0-a285-00aa003049e2}"
|
|
# The user class (https://learn.microsoft.com/en-us/windows/win32/adschema/c-user)
|
|
ObjectType|contains: 'bf967aba-0de6-11d0-a285-00aa003049e2'
|
|
AccessMask|endswith:
|
|
# Note: Since the Access Mask can have more than once permission we need to add all permutations that include the READ property
|
|
- '1?' # This covers all access masks that are 1 bytes or shorter and the "Read Property" itself
|
|
- '3?' # Read Property + Write Property
|
|
- '4?' # Read Property + Delete Tree
|
|
- '7?' # Read Property + Write Property + Delete Tree
|
|
- '9?' # Read Property + List Object
|
|
- 'B?' # Read Property + Write Property + List Object
|
|
- 'D?' # Read Property + Delete Tree + List Object
|
|
- 'F?' # Covers usage of all possible 2 bytes permissions with any or none of the single byte permissions
|
|
filter_main_machine_accounts:
|
|
SubjectUserName|endswith: '$' # Exclude machine accounts
|
|
filter_main_msql:
|
|
SubjectUserName|startswith: 'MSOL_' # https://learn.microsoft.com/en-us/azure/active-directory/hybrid/reference-connect-accounts-permissions#ad-ds-connector-account
|
|
condition: selection and not 1 of filter_main_*
|
|
falsepositives:
|
|
- Administrators configuring new users.
|
|
level: medium
|