security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] User Added to Privileged Group (#3763)

Browse Source 
* [New Rule] User Added to Privileged Group

* add more groups

* Update rules/windows/persistence_user_account_added_to_privileged_group_ad.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Update persistence_user_account_added_to_privileged_group_ad.toml

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

(cherry picked from commit 087e8a6e85)
This commit is contained in:
Jonhnathan
2024-06-07 13:43:30 -03:00
committed by github-actions[bot]
parent dbfdb7f804
commit fff49e7f09
1 changed files with 34 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/persistence_user_account_added_to_privileged_group_ad.toml
+34 -10
View File
@@ -2,7 +2,7 @@
creation_date = "2021/01/09"
integration = ["system", "windows"]
maturity = "production"
updated_date = "2024/05/21"
updated_date = "2024/06/07"
[rule]
author = ["Elastic", "Skoetting"]
@@ -72,15 +72,39 @@ timestamp_override = "event.ingested"
type = "eql"
query = '''
iam where winlog.api:"wineventlog" and event.action == "added-member-to-group" and
group.name : ("Admin*",
"Local Administrators",
"Domain Admins",
"Enterprise Admins",
"Backup Admins",
"Schema Admins",
"DnsAdmins",
"Exchange Organization Administrators")
iam where winlog.api == "wineventlog" and event.action == "added-member-to-group" and
(
(
group.name : (
"Admin*",
"Local Administrators",
"Domain Admins",
"Enterprise Admins",
"Backup Admins",
"Schema Admins",
"DnsAdmins",
"Exchange Organization Administrators",
"Print Operators",
"Server Operators",
"Account Operators"
)
) or
(
group.id : (
"S-1-5-32-544",
"S-1-5-21-*-544",
"S-1-5-21-*-512",
"S-1-5-21-*-519",
"S-1-5-21-*-551",
"S-1-5-21-*-518",
"S-1-5-21-*-1101",
"S-1-5-21-*-1102",
"S-1-5-21-*-550",
"S-1-5-21-*-549",
"S-1-5-21-*-548"
)
)
)
'''