Detection rules › Kusto Query Language

Gain Code Execution on ADFS Server via SMB + Remote Service or Scheduled Task

Source: upstream

'This query detects instances where an attacker has gained the ability to execute code on an ADFS Server through SMB and Remote Service or Scheduled Task.'

MITRE ATT&CK coverage

Tactic	Techniques
Lateral Movement	`T1210` Exploitation of Remote Services

Event coverage

Provider	Event ID	Title
Security-Auditing	4624	An account was successfully logged on.
Security-Auditing	4688	A new process has been created.
Security-Auditing	4697	A service was installed in the system.
Security-Auditing	4698	A scheduled task was created.
Security-Auditing	4699	A scheduled task was deleted.
Security-Auditing	4700	A scheduled task was enabled.
Security-Auditing	4701	A scheduled task was disabled.
Security-Auditing	4702	A scheduled task was updated.
Security-Auditing	5145	A network share object was checked to see whether client can be granted desired access.

Stages and Predicates

Stage 1: `source`

SecurityEvent

Stage 2: `where`

 macro "(TimeGenerated > ago(timeframe))"

Stage 3: `where`

Computer eq "ADFS_Servers"

Stage 4: `where`

not
  Account ends_with "$"

Stage 5: `where`

EventID in ["4697", "4698", "4699", "4700", "4701", "4702"]

Stage 6: `extend`

Stage 7: `extend`

Stage 8: `union`

union of 1 branches

Stage 9: `join`

Stage 10: `project`

Stage 11: `extend`

Stage 12: `extend`

Stage 13: `extend`

Stage 14: `extend`

Exclusions

Top-level NOT(...) conjuncts — predicates this rule actively suppresses.

Stage	Field	Kind	Excluded values
1	`Account`	ends_with	`$`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`Computer`	in	`ADFS_Servers`
`EventID`	in	`4697` `4698` corpus 2 (splunk 2) `4699` `4700` corpus 2 (splunk 2) `4701` `4702` corpus 2 (splunk 2)

Gain Code Execution on ADFS Server via SMB + Remote Service or Scheduled Task

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: where

Stage 6: extend

Stage 7: extend

Stage 8: union

Stage 9: join

Stage 10: project

Stage 11: extend

Stage 12: extend

Stage 13: extend

Stage 14: extend