From ca3548c95ea4a719396c6f7edf60bbe5ae801cca Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 30 Jul 2024 15:23:31 -0600 Subject: [PATCH 1/4] Create windows_privileged_group_modification.yml new one for ya --- .../windows_privileged_group_modification.yml | 90 +++++++++++++++++++ 1 file changed, 90 insertions(+) create mode 100644 detections/endpoint/windows_privileged_group_modification.yml diff --git a/detections/endpoint/windows_privileged_group_modification.yml b/detections/endpoint/windows_privileged_group_modification.yml new file mode 100644 index 0000000000..113ded7260 --- /dev/null +++ b/detections/endpoint/windows_privileged_group_modification.yml @@ -0,0 +1,90 @@ +name: Windows Privileged Group Modification +id: b8cbef2c-2cc3-4550-b0fc-9715b7852df9 +version: 1 +date: '2024-07-30' +author: Brandon Sternfield, Optiv + ClearShark +data_sources: [] +type: TTP +status: production +description: This analytic detects modifications to privileged groups in Active Directory, including creation, deletion, and changes to various types of groups such as local, global, universal, and LDAP query groups. It specifically monitors for changes to high-privilege groups like "Administrators", "Domain Admins", "Enterprise Admins", and "ESX Admins", among others. This detection is particularly relevant in the context of potential exploitation of vulnerabilities like the VMware ESXi Active Directory Integration Authentication Bypass (CVE-2024-37085), where attackers may attempt to manipulate privileged groups to gain unauthorized access to systems. +search: '`wineventlog_security` PrivilegeList SidHistory + SamAccountName TargetDomainName TargetUserName + | search EventCode IN (4727,4731,4744,4749,4754,4759,4783,4790) + | eval object_category=case( + EventCode=="4731", "Local Group (Security)", + EventCode=="4744", "Local Group (Distribution)", + EventCode=="4727", "Global Group (Security)", + EventCode=="4749", "Global Group (Distribution)", + EventCode=="4754", "Universal Group (Security)", + EventCode=="4759", "Universal Group (Distribution)", + EventCode=="4783", "Basic Application Group", + EventCode=="4790", "LDAP Query Group") + | search TargetUserName IN ("Account Operators", "Administrators", + "Admins DNS", "Backup Operators", "DnsAdmins", "Domain Admins", + "Enterprise Admins", "Enterprise Key Admins", "ESX Admins", + "ESXi Admins", "Group Policy Creator Owners", "Hyper-V Administrators", + "Key Admins", "Print Operators", "Remote Desktop Users", "Remote Management Users", + "Replicators", "Schema Admins", "Server Operators") + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode src_user object_category TargetUserName TargetSid dest result status + | rename Computer as dest result AS change_type, TargetUserName AS object, TargetSid AS object_path | `windows_privileged_group_modification_filter`' +how_to_implement: To successfully implement this search, ensure that Windows Security Event logging is enabled and being ingested into Splunk, particularly for event codes 4727, 4730, and 4737. Configure Group Policy settings to audit these specific events. +known_false_positives: Legitimate administrators might create, delete, or modify an a privileged group for valid reasons. Verify that the group changes are authorized and part of normal administrative tasks. Consider the context of the action, such as the user performing it and any related activities. +references: +- https://nvd.nist.gov/vuln/detail/CVE-2024-37085 +- https://www.rapid7.com/blog/post/2024/07/30/vmware-esxi-cve-2024-37085-targeted-in-ransomware-campaigns/%5C +- https://x.com/mthcht/status/1818196168515461431?s=12&t=kwffmj0KM1sZtg3MrqC0QQ +tags: + analytic_story: + - VMware ESXi AD Integration Authentication Bypass CVE-2024-37085 + asset_type: Endpoint + confidence: 80 + impact: 100 + message: A privileged group modification was detected. Group "$object$" ($object_category$) was $change_type$ on $dest$ by user $src_user$. + mitre_attack_id: + - T1136.001 + - T1136.002 + observable: + - name: src_user + type: User + role: + - Attacker + - name: dest + type: Hostname + role: + - Victim + - name: object + type: Other + role: + - Target + - name: object_category + type: Other + role: + - Other + - name: change_type + type: Other + role: + - Other + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - EventCode + - src_user + - object_category + - TargetUserName + - TargetSid + - dest + - result + - status + - _time + risk_score: 80 + security_domain: endpoint + cve: + - CVE-2024-37085 +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security-esxadmins.log + sourcetype: XmlWinEventLog + source: Security \ No newline at end of file From 8c8b3335172247237eaee69aa22a18d04666aac6 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 30 Jul 2024 14:29:01 -0700 Subject: [PATCH 2/4] updating data sources --- .../endpoint/windows_privileged_group_modification.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/windows_privileged_group_modification.yml b/detections/endpoint/windows_privileged_group_modification.yml index 113ded7260..484caf6355 100644 --- a/detections/endpoint/windows_privileged_group_modification.yml +++ b/detections/endpoint/windows_privileged_group_modification.yml @@ -3,7 +3,15 @@ id: b8cbef2c-2cc3-4550-b0fc-9715b7852df9 version: 1 date: '2024-07-30' author: Brandon Sternfield, Optiv + ClearShark -data_sources: [] +data_sources: +- Windows Event Log Security 4727 +- Windows Event Log Security 4731 +- Windows Event Log Security 4744 +- Windows Event Log Security 4749 +- Windows Event Log Security 4754 +- Windows Event Log Security 4759 +- Windows Event Log Security 4783 +- Windows Event Log Security 4790 type: TTP status: production description: This analytic detects modifications to privileged groups in Active Directory, including creation, deletion, and changes to various types of groups such as local, global, universal, and LDAP query groups. It specifically monitors for changes to high-privilege groups like "Administrators", "Domain Admins", "Enterprise Admins", and "ESX Admins", among others. This detection is particularly relevant in the context of potential exploitation of vulnerabilities like the VMware ESXi Active Directory Integration Authentication Bypass (CVE-2024-37085), where attackers may attempt to manipulate privileged groups to gain unauthorized access to systems. From 97e1f74307e707e468bff072e994aa244420e9d7 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 30 Jul 2024 15:45:02 -0600 Subject: [PATCH 3/4] Update windows_privileged_group_modification.yml --- detections/endpoint/windows_privileged_group_modification.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_privileged_group_modification.yml b/detections/endpoint/windows_privileged_group_modification.yml index 484caf6355..e7e00419ee 100644 --- a/detections/endpoint/windows_privileged_group_modification.yml +++ b/detections/endpoint/windows_privileged_group_modification.yml @@ -94,5 +94,5 @@ tests: - name: True Positive Test attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security-esxadmins.log - sourcetype: XmlWinEventLog - source: Security \ No newline at end of file + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog \ No newline at end of file From 660dcd0cc5ace8d297124477f63a9def9450a388 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 30 Jul 2024 16:17:33 -0600 Subject: [PATCH 4/4] Update windows_privileged_group_modification.yml --- .../windows_privileged_group_modification.yml | 33 ++++++++----------- 1 file changed, 13 insertions(+), 20 deletions(-) diff --git a/detections/endpoint/windows_privileged_group_modification.yml b/detections/endpoint/windows_privileged_group_modification.yml index e7e00419ee..d9505bdb38 100644 --- a/detections/endpoint/windows_privileged_group_modification.yml +++ b/detections/endpoint/windows_privileged_group_modification.yml @@ -14,27 +14,20 @@ data_sources: - Windows Event Log Security 4790 type: TTP status: production -description: This analytic detects modifications to privileged groups in Active Directory, including creation, deletion, and changes to various types of groups such as local, global, universal, and LDAP query groups. It specifically monitors for changes to high-privilege groups like "Administrators", "Domain Admins", "Enterprise Admins", and "ESX Admins", among others. This detection is particularly relevant in the context of potential exploitation of vulnerabilities like the VMware ESXi Active Directory Integration Authentication Bypass (CVE-2024-37085), where attackers may attempt to manipulate privileged groups to gain unauthorized access to systems. -search: '`wineventlog_security` PrivilegeList SidHistory - SamAccountName TargetDomainName TargetUserName - | search EventCode IN (4727,4731,4744,4749,4754,4759,4783,4790) +description: 'This analytic detects modifications to privileged groups in Active Directory, including creation, deletion, and changes to various types of groups such as local, global, universal, and LDAP query groups. It specifically monitors for changes to high-privilege groups like "Administrators", "Domain Admins", "Enterprise Admins", and "ESX Admins", among others. This detection is particularly relevant in the context of potential exploitation of vulnerabilities like the VMware ESXi Active Directory Integration Authentication Bypass (CVE-2024-37085), where attackers may attempt to manipulate privileged groups to gain unauthorized access to systems.' +search: '`wineventlog_security` EventCode IN (4727,4731,4744,4749,4754,4759,4783,4790) TargetUserName IN ("Account Operators", "Administrators", "Admins DNS", "Backup Operators", "DnsAdmins", "Domain Admins", "Enterprise Admins", "Enterprise Key Admins", "ESX Admins", "ESXi Admins", "Group Policy Creator Owners", "Hyper-V Administrators", "Key Admins", "Print Operators", "Remote Desktop Users", "Remote Management Users", "Replicators", "Schema Admins", "Server Operators") | eval object_category=case( - EventCode=="4731", "Local Group (Security)", - EventCode=="4744", "Local Group (Distribution)", - EventCode=="4727", "Global Group (Security)", - EventCode=="4749", "Global Group (Distribution)", - EventCode=="4754", "Universal Group (Security)", - EventCode=="4759", "Universal Group (Distribution)", - EventCode=="4783", "Basic Application Group", - EventCode=="4790", "LDAP Query Group") - | search TargetUserName IN ("Account Operators", "Administrators", - "Admins DNS", "Backup Operators", "DnsAdmins", "Domain Admins", - "Enterprise Admins", "Enterprise Key Admins", "ESX Admins", - "ESXi Admins", "Group Policy Creator Owners", "Hyper-V Administrators", - "Key Admins", "Print Operators", "Remote Desktop Users", "Remote Management Users", - "Replicators", "Schema Admins", "Server Operators") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode src_user object_category TargetUserName TargetSid dest result status - | rename Computer as dest result AS change_type, TargetUserName AS object, TargetSid AS object_path | `windows_privileged_group_modification_filter`' + EventCode="4731", "Local Group (Security)", + EventCode="4744", "Local Group (Distribution)", + EventCode="4727", "Global Group (Security)", + EventCode="4749", "Global Group (Distribution)", + EventCode="4754", "Universal Group (Security)", + EventCode="4759", "Universal Group (Distribution)", + EventCode="4783", "Basic Application Group", + EventCode="4790", "LDAP Query Group") + | rename Computer as dest, result AS change_type, TargetUserName AS object, TargetSid AS object_path + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode src_user object_category object object_path dest change_type status + | `windows_privileged_group_modification_filter`' how_to_implement: To successfully implement this search, ensure that Windows Security Event logging is enabled and being ingested into Splunk, particularly for event codes 4727, 4730, and 4737. Configure Group Policy settings to audit these specific events. known_false_positives: Legitimate administrators might create, delete, or modify an a privileged group for valid reasons. Verify that the group changes are authorized and part of normal administrative tasks. Consider the context of the action, such as the user performing it and any related activities. references: