Skip to content

Commit be099bc

Browse files
patel-bhavinpatel-bhavin
authored
Merge pull request #3641 from splunk/dean_slack_bug
updating SPL with deans feedback
2 parents 593ec5b + 4c07f16 commit be099bc

File tree

2 files changed

+35
-44
lines changed

2 files changed

+35
-44
lines changed

‎detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml‎

Lines changed: 15 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,32 @@
11
name: Windows AD Replication Request Initiated by User Account
22
id: 51307514-1236-49f6-8686-d46d93cc2821
3-
version: 10
4-
date: '2025-05-02'
3+
version: 11
4+
date: '2025-08-11'
55
author: Dean Luxton
66
type: TTP
77
status: production
88
data_source:
99
- Windows Event Log Security 4662
10+
- Windows Event Log Security 4624
1011
description: The following analytic detects a user account initiating an Active Directory
1112
replication request, indicative of a DCSync attack. It leverages EventCode 4662
1213
from the Windows Security Event Log, focusing on specific object types and replication
1314
permissions. This activity is significant because it can allow an attacker with
1415
sufficient privileges to request password hashes for any or all users within the
1516
domain. If confirmed malicious, this could lead to unauthorized access, privilege
1617
escalation, and potential compromise of the entire domain.
17-
search: "`wineventlog_security` EventCode=4662 ObjectType IN (\"%{19195a5b-6da0-11d0-afd3-00c04fd930c9}\"\
18-
,\"domainDNS\") \n AND Properties IN (\"*Replicating Directory Changes All*\"\
19-
, \"*{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}*\",\"*{9923a32a-3607-11d2-b9be-0000f87a36b2}*\"\
20-
,\"*{1131f6ac-9c07-11d1-f79f-00c04fc2dcd2}*\")\n AND AccessMask=\"0x100\" AND\
21-
\ NOT (SubjectUserSid=\"NT AUT*\" OR SubjectUserSid=\"S-1-5-18\" OR SubjectDomainName=\"\
22-
Window Manager\" OR SubjectUserName=\"*$\") \n| stats min(_time) as _time, count\
23-
\ by SubjectDomainName, SubjectUserName, Computer, Logon_ID, ObjectName, ObjectServer,\
24-
\ ObjectType, OperationType, status dest | rename SubjectDomainName as Target_Domain,\
25-
\ SubjectUserName as user, Logon_ID as TargetLogonId, _time as attack_time | appendpipe\
26-
\ \n [| map search=\"search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$\"\
27-
\ | fields - status] \n| table attack_time, AuthenticationPackageName, LogonProcessName,\
28-
\ LogonType, TargetUserSid, Target_Domain, user, Computer, TargetLogonId, status,\
29-
\ src_ip, src_category, ObjectName, ObjectServer, ObjectType, OperationType, dest\
30-
\ | stats min(attack_time) as _time values(TargetUserSid) as TargetUserSid, values(Target_Domain)\
31-
\ as Target_Domain, values(user) as user, values(Computer) as Computer, values(status)\
32-
\ as status, values(src_category) as\n src_category, values(src_ip) as src_ip\
33-
\ by TargetLogonId dest\n| `windows_ad_replication_request_initiated_by_user_account_filter`"
18+
search: |-
19+
`wineventlog_security` EventCode=4662 ObjectType IN ("%{19195a5b-6da0-11d0-afd3-00c04fd930c9}","domainDNS")
20+
AND Properties IN ("*Replicating Directory Changes All*","*Manage Replication Topology*","*Remove Replica In Domain*","*{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}*","*{9923a32a-3607-11d2-b9be-0000f87a36b2}*","*{1131f6ac-9c07-11d1-f79f-00c04fc2dcd2}*")
21+
AND AccessMask="0x100" AND NOT (SubjectUserSid="NT AUT*" OR SubjectUserSid="S-1-5-18" OR SubjectDomainName="Window Manager" OR SubjectUserName="*$")
22+
| stats min(_time) as _time, count by SubjectDomainName, SubjectUserName, Computer, Logon_ID, ObjectName, ObjectServer, ObjectType, OperationType, status dest
23+
| rename SubjectDomainName as Target_Domain, SubjectUserName as user, Logon_ID as TargetLogonId, _time as attack_time
24+
| appendpipe
25+
[| map search="search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$"
26+
| fields - status]
27+
| stats min(attack_time) as _time values(TargetUserSid) as TargetUserSid, values(Target_Domain) as Target_Domain, values(user) as user, values(Computer) as Computer, values(status) as status, values(src_category) as
28+
src_category, values(src_ip) as src_ip values(action) as action values(authentication_method) as authentication_method values(dest) as dest values(signature) as signature values(signature_id) as signature_id by TargetLogonId
29+
| `windows_ad_replication_request_initiated_by_user_account_filter`
3430
how_to_implement: To successfully implement this search, you need to be ingesting
3531
eventcode `4662`. The Advanced Security Audit policy settings `Audit Directory Services
3632
Access` within `DS Access` needs to be enabled, as well as the following SACLs applied

‎detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml‎

Lines changed: 20 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Windows AD Replication Request Initiated from Unsanctioned Location
22
id: 50998483-bb15-457b-a870-965080d9e3d3
3-
version: 11
4-
date: '2025-05-05'
3+
version: 12
4+
date: '2025-08-11'
55
author: Dean Luxton
66
type: TTP
77
status: production
@@ -17,25 +17,23 @@ description:
1717
access can request password hashes for any or all users within the domain. If confirmed
1818
malicious, this could lead to unauthorized access to sensitive information and potential
1919
full domain compromise.
20-
search:
21-
'`wineventlog_security` EventCode=4662 ObjectType IN ("%{19195a5b-6da0-11d0-afd3-00c04fd930c9}",
22-
"domainDNS") AND Properties IN ("*Replicating Directory Changes All*", "*{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}*",
23-
"*{9923a32a-3607-11d2-b9be-0000f87a36b2}*","*{1131f6ac-9c07-11d1-f79f-00c04fc2dcd2}*")
24-
AND AccessMask="0x100" AND (SubjectUserSid="NT AUT*" OR SubjectUserSid="S-1-5-18"
25-
OR SubjectDomainName="Window Manager" OR SubjectUserName="*$") | stats min(_time)
26-
as attack_time, count by SubjectDomainName SubjectUserName Computer Logon_ID ObjectName
27-
ObjectServer ObjectType OperationType status action app authentication_method dest
28-
dvc process process_id process_name process_path signature signature_id src src_port
29-
subject user user_group vendor_product | rename SubjectDomainName as Target_Domain,
30-
SubjectUserName as user, Logon_ID as TargetLogonId | appendpipe [| map search="search
31-
`wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$"] | table attack_time,
32-
AuthenticationPackageName, LogonProcessName, LogonType, TargetUserSid, Target_Domain,
33-
user, Computer, TargetLogonId, status, src_ip, src_category, ObjectName, ObjectServer,
34-
ObjectType, OperationType | stats min(attack_time) as _time, values(TargetUserSid)
35-
as TargetUserSid, values(Target_Domain) as Target_Domain, values(user) as user,
36-
values(Computer) as Computer, values(status) as status, values(src_category) as
37-
src_category, values(src_ip) as src_ip by TargetLogonId | search NOT src_category="domain_controller"
38-
| `windows_ad_replication_request_initiated_from_unsanctioned_location_filter`'
20+
search: |-
21+
`wineventlog_security` EventCode=4662 ObjectType IN ("%{19195a5b-6da0-11d0-afd3-00c04fd930c9}",
22+
"domainDNS") AND Properties IN ("*Replicating Directory Changes All*","*Manage Replication Topology*","*Remove Replica In Domain*","*{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}*","*{9923a32a-3607-11d2-b9be-0000f87a36b2}*","*{1131f6ac-9c07-11d1-f79f-00c04fc2dcd2}*")
23+
AND AccessMask="0x100" AND (SubjectUserSid="NT AUT*" OR SubjectUserSid="S-1-5-18"
24+
OR SubjectDomainName="Window Manager" OR SubjectUserName="*$")
25+
| stats min(_time)
26+
as attack_time, count by SubjectDomainName, SubjectUserName, Computer, Logon_ID, ObjectName, ObjectServer, ObjectType, OperationType, status
27+
| rename SubjectDomainName
28+
as Target_Domain, SubjectUserName as user, Logon_ID as TargetLogonId
29+
| appendpipe
30+
[| map search="search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$"]
31+
| stats min(attack_time) as _time, values(TargetUserSid)
32+
as TargetUserSid, values(Target_Domain) as Target_Domain, values(user) as user,
33+
values(Computer) as Computer, values(status) as status, values(src_category) as
34+
src_category, values(src_ip) as src_ip values(action) as action values(authentication_method) as authentication_method values(dest) as dest values(signature) as signature values(signature_id) as signature_id by TargetLogonId
35+
| search NOT src_category="domain_controller"
36+
| `windows_ad_replication_request_initiated_from_unsanctioned_location_filter`
3937
how_to_implement:
4038
To successfully implement this search, you need to be ingesting
4139
eventcode `4662`. The Advanced Security Audit policy settings `Audit Directory Services
@@ -45,7 +43,7 @@ how_to_implement:
4543
Changes`, `Replicating Directory Changes All`, and `Replicating Directory Changes
4644
In Filtered Set` Assets and Identities will also need to be configured, with the
4745
category of domain_controller added for domain controllers.
48-
known_false_positives: Genuine DC promotion may trigger this alert.
46+
known_false_positives: Genuine DC promotion may trigger this alert.
4947
references:
5048
- https://adsecurity.org/?p=1729
5149
- https://www.linkedin.com/pulse/mimikatz-dcsync-event-log-detections-john-dwyer
@@ -90,9 +88,6 @@ tags:
9088
- Splunk Enterprise Security
9189
- Splunk Cloud
9290
security_domain: endpoint
93-
manual_test:
94-
This detection runs correctly when run manually and given some time
95-
is given for data to settle in the splunk index.
9691
tests:
9792
- name: True Positive Test
9893
attack_data:

0 commit comments

Comments
 (0)