Jonhnathan
7c90f1d4c4
* Initial commit
* Update Investigation guides - security-docs review
* Update command_and_control_dns_tunneling_nslookup.toml
* Update defense_evasion_amsienable_key_mod.toml
* Apply security-docs review
* Remove dot
* Update rules/windows/command_and_control_rdp_tunnel_plink.toml
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>
* Apply changes from review
* Apply the suggestion
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>
(cherry picked from commit 817b97f428)
100 lines
3.7 KiB
TOML
100 lines
3.7 KiB
TOML
[metadata]
|
|
creation_date = "2021/11/08"
|
|
maturity = "production"
|
|
updated_date = "2022/03/02"
|
|
|
|
[rule]
|
|
author = ["Elastic"]
|
|
description = """
|
|
Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or
|
|
use them to add users as local admins.
|
|
"""
|
|
index = ["winlogbeat-*", "logs-system.*"]
|
|
language = "kuery"
|
|
license = "Elastic License v2"
|
|
name = "Group Policy Abuse for Privilege Addition"
|
|
note = """## Triage and analysis
|
|
|
|
### Investigating Group Policy Abuse for Privilege Addition
|
|
|
|
Group Policy Objects (GPOs) can be used to add rights and/or modify Group Membership on GPOs by changing the contents of an INF
|
|
file named GptTmpl.inf, which is responsible for storing every setting under the Security Settings container in the GPO.
|
|
This file is unique for each GPO, and only exists if the GPO contains security settings.
|
|
Example Path: "\\\\DC.com\\SysVol\\DC.com\\Policies\\{PolicyGUID}\\Machine\\Microsoft\\Windows NT\\SecEdit\\GptTmpl.inf"
|
|
|
|
#### Possible investigation steps
|
|
|
|
- This attack abuses a legitimate mechanism of Active Directory, so it is important to determine whether the activity
|
|
is legitimate and the administrator is authorized to perform this operation.
|
|
- Retrieve the contents of the `GptTmpl.inf` file, and under the `Privilege Rights` section, look for potentially
|
|
dangerous high privileges, for example: SeTakeOwnershipPrivilege, SeEnableDelegationPrivilege, etc.
|
|
- Inspect the user security identifiers (SIDs) associated with these privileges, and if they should have these privileges.
|
|
|
|
### False positive analysis
|
|
|
|
- Inspect whether the user that has done the modifications should be allowed to. The user name can be found in the
|
|
`winlog.event_data.SubjectUserName` field.
|
|
|
|
### Related rules
|
|
|
|
- Scheduled Task Execution at Scale via GPO - 15a8ba77-1c13-4274-88fe-6bd14133861e
|
|
- Startup/Logon Script added to Group Policy Object - 16fac1a1-21ee-4ca6-b720-458e3855d046
|
|
|
|
### Response and remediation
|
|
|
|
- Initiate the incident response process based on the outcome of the triage.
|
|
- The investigation and containment must be performed in every computer controlled by the GPO, where necessary.
|
|
- Remove the script from the GPO.
|
|
- Check if other GPOs have suspicious scripts attached.
|
|
|
|
## Config
|
|
|
|
The 'Audit Directory Service Changes' audit policy must be configured (Success Failure).
|
|
Steps to implement the logging policy with with Advanced Audit Configuration:
|
|
|
|
```
|
|
Computer Configuration >
|
|
Policies >
|
|
Windows Settings >
|
|
Security Settings >
|
|
Advanced Audit Policies Configuration >
|
|
Audit Policies >
|
|
DS Access >
|
|
Audit Directory Service Changes (Success,Failure)
|
|
```
|
|
"""
|
|
references = [
|
|
"https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0025_windows_audit_directory_service_changes.md",
|
|
"https://labs.f-secure.com/tools/sharpgpoabuse",
|
|
]
|
|
risk_score = 73
|
|
rule_id = "b9554892-5e0e-424b-83a0-5aef95aa43bf"
|
|
severity = "high"
|
|
tags = ["Elastic", "Host", "Windows", "Threat Detection", "Privilege Escalation", "Active Directory"]
|
|
timestamp_override = "event.ingested"
|
|
type = "query"
|
|
|
|
query = '''
|
|
event.code: "5136" and winlog.event_data.AttributeLDAPDisplayName:"gPCMachineExtensionNames" and
|
|
winlog.event_data.AttributeValue:(*827D319E-6EAC-11D2-A4EA-00C04F79F83A* and *803E14A0-B4FB-11D0-A0D0-00A0C90F574B*)
|
|
'''
|
|
|
|
|
|
[[rule.threat]]
|
|
framework = "MITRE ATT&CK"
|
|
|
|
[[rule.threat.technique]]
|
|
reference = "https://attack.mitre.org/techniques/T1484/"
|
|
id = "T1484"
|
|
name = "Domain Policy Modification"
|
|
|
|
[[rule.threat.technique.subtechnique]]
|
|
reference = "https://attack.mitre.org/techniques/T1484/001/"
|
|
id = "T1484.001"
|
|
name = "Group Policy Modification"
|
|
|
|
[rule.threat.tactic]
|
|
reference = "https://attack.mitre.org/tactics/TA0004/"
|
|
id = "TA0004"
|
|
name = "Privilege Escalation"
|