Skip to content

Adding AD Privilege Escalation SRS Detections - #2664

Merged
patel-bhavin merged 24 commits into
developfrom
SRS_AD_PrivEsc
May 26, 2023
Merged

patel-bhavin merged 24 commits into
developfrom
SRS_AD_PrivEsc

Conversation

@mvelazc0

@mvelazc0 mvelazc0 commented May 3, 2023 •

Copy link
Copy Markdown
Contributor

Details

This PR includes 5 new SRS detections for Active Directory privilege escalation. All detections have been tested.

New Detections

  • Windows PowerSploit GPP Discovery - PASSED
  • Windows Findstr GPP Discovery - PASSED
  • Windows File Share Discovery With Powerview - PASSED
  • Windows Default Group Policy Object Modified with GPME - PASSED
  • Windows PowerView AD Access Control List Enumeration - PASSED

image

image

image

image

Checklist

  • Validate name matches <platform>_<mitre att&ck technique>_<short description> nomenclature
  • CI/CD jobs passed ✔️
  • Validated SPL logic.
  • Validated tags, description, and how to implement.
  • Verified references match analytic.

@mvelazc0 mvelazc0 added the WIP DO NOT MERGE Work in Progress label May 3, 2023
@mvelazc0 mvelazc0 added 4.3.0 and removed WIP DO NOT MERGE Work in Progress labels May 17, 2023
@patel-bhavin
patel-bhavin merged commit 00d0915 into develop May 26, 2023
@delete-merged-branch
delete-merged-branch Bot deleted the SRS_AD_PrivEsc branch May 26, 2023 18:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants