Detection rules › Splunk

Windows AD Suspicious Attribute Modification

Author
Dean Luxton
Source
upstream

This detection monitors changes to the following Active Directory attributes: "msDS-AllowedToDelegateTo", "msDS-AllowedToActOnBehalfOfOtherIdentity", "msDS-KeyCredentialLink", "scriptPath", and "msTSInitialProgram". Modifications to these attributes can indicate potential malicious activity or privilege escalation attempts. Immediate investigation is recommended upon alert.

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1222.001 File and Directory Permissions Modification: Windows File and Directory Permissions Modification, T1550 Use Alternate Authentication Material
Lateral MovementT1550 Use Alternate Authentication Material

Event coverage

ProviderEvent IDTitle
Security-Auditing5136A directory service object was modified.

Stages and Predicates

Stage 1: search

search AttributeLDAPDisplayName IN ("msDS-AllowedToActOnBehalfOfOtherIdentity", "msDS-AllowedToDelegateTo", "msTSInitialProgram", "scriptPath") EventCode=5136 OperationType="%%14674"

Stage 2: table

table AttributeLDAPDisplayName, AttributeValue, DSName, ObjectClass, ObjectDN, OpCorrelationID, SubjectLogonId, _time, src_user

Stage 3: rename

rename

Stage 4: appendpipe

appendpipe

Stage 5: stats

stats BY TargetLogonId

Stage 6: rex

rex field=ObjectDN ...

Stage 7: eval

eval ... using (ObjectClass, cn, null)

Stage 8: fields

fields cn

Stage 9: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
AttributeLDAPDisplayNamein
  • "msDS-AllowedToActOnBehalfOfOtherIdentity"
  • "msDS-AllowedToDelegateTo"
  • "msTSInitialProgram"
  • "scriptPath"
EventCodeeq
  • 5136 corpus 22 (splunk 22)
OperationTypeeq
  • %%14674 corpus 4 (elastic 3, splunk 1)

Neighbors

Broader alternatives (more inclusive than this rule)

These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.