Detection rules › Elastic
Access to a Sensitive LDAP Attribute
Identify access to sensitive Active Directory object attributes that contains credentials and decryption keys such as unixUserPassword, ms-PKI-AccountCredentials and msPKI-CredentialRoamingTokens.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1078 Valid Accounts, T1078.002 Valid Accounts: Domain Accounts |
| Persistence | T1078 Valid Accounts, T1078.002 Valid Accounts: Domain Accounts |
| Privilege Escalation | T1078 Valid Accounts, T1078.002 Valid Accounts: Domain Accounts |
| Defense Evasion | T1078 Valid Accounts, T1078.002 Valid Accounts: Domain Accounts |
| Credential Access | T1003 OS Credential Dumping, T1552 Unsecured Credentials, T1552.004 Unsecured Credentials: Private Keys, T1649 Steal or Forge Authentication Certificates |
| Collection | T1213 Data from Information Repositories |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Security-Auditing | 4662 | An operation was performed on an object. |
Stages and Predicates
Stage 1: eql:any
not winlog.event_data.AccessMask:(0x0 or 0x100) and not winlog.event_data.SubjectUserSid:"S-1-5-18" and winlog.event_data.Properties:"612cb747-c0e8-4f92-9221-fdd5f15b550d"Exclusions
Top-level NOT(...) conjuncts — predicates this rule actively suppresses.
| Stage | Field | Kind | Excluded values |
|---|---|---|---|
| 1 | AccessMask | in | 0x0, 0x100 |
| 2 | SubjectUserSid | eq | S-1-5-18 |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
winlog.event_data.Properties | wildcard |
|