Skip to content

Commit 7d43731

Browse files
patel-bhavinpatel-bhavin
authored
Merge branch 'develop' into 3886
2 parents 9cff1a1 + 6433b52 commit 7d43731

8 files changed

+44
-53
lines changed

‎.github/workflows/appinspect.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ jobs:
1010
runs-on: ubuntu-latest
1111
steps:
1212
- name: Check out the repository code
13-
uses: actions/checkout@v4
13+
uses: actions/checkout@v5
1414
with:
1515
ref: refs/pull/${{ github.event.pull_request.number }}/merge
1616

‎.github/workflows/build.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ jobs:
1010
runs-on: ubuntu-latest
1111
steps:
1212
- name: Check out the repository code
13-
uses: actions/checkout@v4
13+
uses: actions/checkout@v5
1414

1515
- uses: actions/setup-python@v5
1616
with:

‎.github/workflows/datasource-dependabot.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ jobs:
1111

1212
steps:
1313
- name: Checkout repository
14-
uses: actions/checkout@v4
14+
uses: actions/checkout@v5
1515
with:
1616
ref: 'develop'
1717
token: ${{ secrets.DATA_SOURCES_DEPENDABOT }}

‎.github/workflows/labeler.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ jobs:
99
pull-requests: write
1010
runs-on: ubuntu-latest
1111
steps:
12-
- uses: actions/checkout@v4
12+
- uses: actions/checkout@v5
1313
with:
1414
repository: "splunk/security_content"
1515
- uses: actions/labeler@v5

‎.github/workflows/unit-testing.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ jobs:
99
steps:
1010
#For fork PRs, always check out security_content and the PR target in security content!
1111
- name: Check out the repository code
12-
uses: actions/checkout@v4
12+
uses: actions/checkout@v5
1313
with:
1414
repository: 'splunk/security_content' #this should be the TARGET repo of the PR. we hardcode it for now
1515
ref: ${{ github.base_ref }}

‎contentctl.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -237,10 +237,10 @@ apps:
237237
for flows both on and off premise.
238238
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/cisco-endpoint-security-analytics-cesa-add-on-for-splunk_407.tgz
239239
- uid: 5603
240-
title: Splunk Add-on for VMware ESXi Logs
241-
appid: SPLUNK_ADD_ON_FOR_VMWARE_ESXI_LOGS
242-
version: 4.2.1
243-
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-vmware-esxi-logs_421.tgz
240+
title: Add-on for VMware ESXi Logs
241+
appid: Splunk_TA_esxilogs
242+
version: 4.2.2
243+
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-vmware-esxi-logs_422.tgz
244244
- uid: 5640
245245
title: Splunk Add-on for VMware Indexes
246246
appid: SPLUNK_ADD_ON_FOR_VMWARE_INDEXES

‎detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml‎

Lines changed: 15 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,32 @@
11
name: Windows AD Replication Request Initiated by User Account
22
id: 51307514-1236-49f6-8686-d46d93cc2821
3-
version: 10
4-
date: '2025-05-02'
3+
version: 11
4+
date: '2025-08-11'
55
author: Dean Luxton
66
type: TTP
77
status: production
88
data_source:
99
- Windows Event Log Security 4662
10+
- Windows Event Log Security 4624
1011
description: The following analytic detects a user account initiating an Active Directory
1112
replication request, indicative of a DCSync attack. It leverages EventCode 4662
1213
from the Windows Security Event Log, focusing on specific object types and replication
1314
permissions. This activity is significant because it can allow an attacker with
1415
sufficient privileges to request password hashes for any or all users within the
1516
domain. If confirmed malicious, this could lead to unauthorized access, privilege
1617
escalation, and potential compromise of the entire domain.
17-
search: "`wineventlog_security` EventCode=4662 ObjectType IN (\"%{19195a5b-6da0-11d0-afd3-00c04fd930c9}\"\
18-
,\"domainDNS\") \n AND Properties IN (\"*Replicating Directory Changes All*\"\
19-
, \"*{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}*\",\"*{9923a32a-3607-11d2-b9be-0000f87a36b2}*\"\
20-
,\"*{1131f6ac-9c07-11d1-f79f-00c04fc2dcd2}*\")\n AND AccessMask=\"0x100\" AND\
21-
\ NOT (SubjectUserSid=\"NT AUT*\" OR SubjectUserSid=\"S-1-5-18\" OR SubjectDomainName=\"\
22-
Window Manager\" OR SubjectUserName=\"*$\") \n| stats min(_time) as _time, count\
23-
\ by SubjectDomainName, SubjectUserName, Computer, Logon_ID, ObjectName, ObjectServer,\
24-
\ ObjectType, OperationType, status dest | rename SubjectDomainName as Target_Domain,\
25-
\ SubjectUserName as user, Logon_ID as TargetLogonId, _time as attack_time | appendpipe\
26-
\ \n [| map search=\"search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$\"\
27-
\ | fields - status] \n| table attack_time, AuthenticationPackageName, LogonProcessName,\
28-
\ LogonType, TargetUserSid, Target_Domain, user, Computer, TargetLogonId, status,\
29-
\ src_ip, src_category, ObjectName, ObjectServer, ObjectType, OperationType, dest\
30-
\ | stats min(attack_time) as _time values(TargetUserSid) as TargetUserSid, values(Target_Domain)\
31-
\ as Target_Domain, values(user) as user, values(Computer) as Computer, values(status)\
32-
\ as status, values(src_category) as\n src_category, values(src_ip) as src_ip\
33-
\ by TargetLogonId dest\n| `windows_ad_replication_request_initiated_by_user_account_filter`"
18+
search: |-
19+
`wineventlog_security` EventCode=4662 ObjectType IN ("%{19195a5b-6da0-11d0-afd3-00c04fd930c9}","domainDNS")
20+
AND Properties IN ("*Replicating Directory Changes All*","*Manage Replication Topology*","*Remove Replica In Domain*","*{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}*","*{9923a32a-3607-11d2-b9be-0000f87a36b2}*","*{1131f6ac-9c07-11d1-f79f-00c04fc2dcd2}*")
21+
AND AccessMask="0x100" AND NOT (SubjectUserSid="NT AUT*" OR SubjectUserSid="S-1-5-18" OR SubjectDomainName="Window Manager" OR SubjectUserName="*$")
22+
| stats min(_time) as _time, count by SubjectDomainName, SubjectUserName, Computer, Logon_ID, ObjectName, ObjectServer, ObjectType, OperationType, status dest
23+
| rename SubjectDomainName as Target_Domain, SubjectUserName as user, Logon_ID as TargetLogonId, _time as attack_time
24+
| appendpipe
25+
[| map search="search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$"
26+
| fields - status]
27+
| stats min(attack_time) as _time values(TargetUserSid) as TargetUserSid, values(Target_Domain) as Target_Domain, values(user) as user, values(Computer) as Computer, values(status) as status, values(src_category) as
28+
src_category, values(src_ip) as src_ip values(action) as action values(authentication_method) as authentication_method values(dest) as dest values(signature) as signature values(signature_id) as signature_id by TargetLogonId
29+
| `windows_ad_replication_request_initiated_by_user_account_filter`
3430
how_to_implement: To successfully implement this search, you need to be ingesting
3531
eventcode `4662`. The Advanced Security Audit policy settings `Audit Directory Services
3632
Access` within `DS Access` needs to be enabled, as well as the following SACLs applied

‎detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml‎

Lines changed: 20 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Windows AD Replication Request Initiated from Unsanctioned Location
22
id: 50998483-bb15-457b-a870-965080d9e3d3
3-
version: 11
4-
date: '2025-05-05'
3+
version: 12
4+
date: '2025-08-11'
55
author: Dean Luxton
66
type: TTP
77
status: production
@@ -17,25 +17,23 @@ description:
1717
access can request password hashes for any or all users within the domain. If confirmed
1818
malicious, this could lead to unauthorized access to sensitive information and potential
1919
full domain compromise.
20-
search:
21-
'`wineventlog_security` EventCode=4662 ObjectType IN ("%{19195a5b-6da0-11d0-afd3-00c04fd930c9}",
22-
"domainDNS") AND Properties IN ("*Replicating Directory Changes All*", "*{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}*",
23-
"*{9923a32a-3607-11d2-b9be-0000f87a36b2}*","*{1131f6ac-9c07-11d1-f79f-00c04fc2dcd2}*")
24-
AND AccessMask="0x100" AND (SubjectUserSid="NT AUT*" OR SubjectUserSid="S-1-5-18"
25-
OR SubjectDomainName="Window Manager" OR SubjectUserName="*$") | stats min(_time)
26-
as attack_time, count by SubjectDomainName SubjectUserName Computer Logon_ID ObjectName
27-
ObjectServer ObjectType OperationType status action app authentication_method dest
28-
dvc process process_id process_name process_path signature signature_id src src_port
29-
subject user user_group vendor_product | rename SubjectDomainName as Target_Domain,
30-
SubjectUserName as user, Logon_ID as TargetLogonId | appendpipe [| map search="search
31-
`wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$"] | table attack_time,
32-
AuthenticationPackageName, LogonProcessName, LogonType, TargetUserSid, Target_Domain,
33-
user, Computer, TargetLogonId, status, src_ip, src_category, ObjectName, ObjectServer,
34-
ObjectType, OperationType | stats min(attack_time) as _time, values(TargetUserSid)
35-
as TargetUserSid, values(Target_Domain) as Target_Domain, values(user) as user,
36-
values(Computer) as Computer, values(status) as status, values(src_category) as
37-
src_category, values(src_ip) as src_ip by TargetLogonId | search NOT src_category="domain_controller"
38-
| `windows_ad_replication_request_initiated_from_unsanctioned_location_filter`'
20+
search: |-
21+
`wineventlog_security` EventCode=4662 ObjectType IN ("%{19195a5b-6da0-11d0-afd3-00c04fd930c9}",
22+
"domainDNS") AND Properties IN ("*Replicating Directory Changes All*","*Manage Replication Topology*","*Remove Replica In Domain*","*{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}*","*{9923a32a-3607-11d2-b9be-0000f87a36b2}*","*{1131f6ac-9c07-11d1-f79f-00c04fc2dcd2}*")
23+
AND AccessMask="0x100" AND (SubjectUserSid="NT AUT*" OR SubjectUserSid="S-1-5-18"
24+
OR SubjectDomainName="Window Manager" OR SubjectUserName="*$")
25+
| stats min(_time)
26+
as attack_time, count by SubjectDomainName, SubjectUserName, Computer, Logon_ID, ObjectName, ObjectServer, ObjectType, OperationType, status
27+
| rename SubjectDomainName
28+
as Target_Domain, SubjectUserName as user, Logon_ID as TargetLogonId
29+
| appendpipe
30+
[| map search="search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$"]
31+
| stats min(attack_time) as _time, values(TargetUserSid)
32+
as TargetUserSid, values(Target_Domain) as Target_Domain, values(user) as user,
33+
values(Computer) as Computer, values(status) as status, values(src_category) as
34+
src_category, values(src_ip) as src_ip values(action) as action values(authentication_method) as authentication_method values(dest) as dest values(signature) as signature values(signature_id) as signature_id by TargetLogonId
35+
| search NOT src_category="domain_controller"
36+
| `windows_ad_replication_request_initiated_from_unsanctioned_location_filter`
3937
how_to_implement:
4038
To successfully implement this search, you need to be ingesting
4139
eventcode `4662`. The Advanced Security Audit policy settings `Audit Directory Services
@@ -45,7 +43,7 @@ how_to_implement:
4543
Changes`, `Replicating Directory Changes All`, and `Replicating Directory Changes
4644
In Filtered Set` Assets and Identities will also need to be configured, with the
4745
category of domain_controller added for domain controllers.
48-
known_false_positives: Genuine DC promotion may trigger this alert.
46+
known_false_positives: Genuine DC promotion may trigger this alert.
4947
references:
5048
- https://adsecurity.org/?p=1729
5149
- https://www.linkedin.com/pulse/mimikatz-dcsync-event-log-detections-john-dwyer
@@ -90,9 +88,6 @@ tags:
9088
- Splunk Enterprise Security
9189
- Splunk Cloud
9290
security_domain: endpoint
93-
manual_test:
94-
This detection runs correctly when run manually and given some time
95-
is given for data to settle in the splunk index.
9691
tests:
9792
- name: True Positive Test
9893
attack_data:

0 commit comments

Comments
 (0)