106 строки
5.3 KiB
YAML
106 строки
5.3 KiB
YAML
id: 66276b14-32c5-4226-88e3-080dacc31ce1
|
|
name: Audit policy manipulation using auditpol utility
|
|
description: |
|
|
This detects attempts to manipulate audit policies using auditpol command.
|
|
This technique was seen in relation to Solorigate attack but the results can indicate potential malicious activity used in different attacks.
|
|
The process name in each data source is commented out as an adversary could rename it. It is advisable to keep process name commented but if the results show unrelated false positives, users may want to uncomment it.
|
|
Refer to auditpol syntax: https://docs.microsoft.com/windows-server/administration/windows-commands/auditpol
|
|
Refer to our M365 blog for details on use during the Solorigate attack:
|
|
https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
|
|
severity: Medium
|
|
requiredDataConnectors:
|
|
- connectorId: SecurityEvents
|
|
dataTypes:
|
|
- SecurityEvent
|
|
- connectorId: MicrosoftThreatProtection
|
|
dataTypes:
|
|
- DeviceProcessEvents
|
|
queryFrequency: 1d
|
|
queryPeriod: 1d
|
|
triggerOperator: gt
|
|
triggerThreshold: 0
|
|
tactics:
|
|
- Execution
|
|
relevantTechniques:
|
|
- T1204
|
|
tags:
|
|
- Solorigate
|
|
- NOBELIUM
|
|
query: |
|
|
let timeframe = 1d;
|
|
let AccountAllowList = dynamic(['SYSTEM']);
|
|
let SubCategoryList = dynamic(["Logoff", "Account Lockout", "User Account Management", "Authorization Policy Change"]); // Add any Category in the list to be allowed or disallowed
|
|
let tokens = dynamic(["clear", "remove", "success:disable","failure:disable"]);
|
|
(union isfuzzy=true
|
|
(
|
|
SecurityEvent
|
|
| where TimeGenerated >= ago(timeframe)
|
|
//| where Process =~ "auditpol.exe"
|
|
| where CommandLine has_any (tokens)
|
|
| where AccountType !~ "Machine" and Account !in~ (AccountAllowList)
|
|
| parse CommandLine with * "/subcategory:" subcategorytoken
|
|
| extend SubCategory = tostring(split(subcategorytoken, "\"")[1]) , Toggle = tostring(split(subcategorytoken, "\"")[2])
|
|
| where SubCategory in~ (SubCategoryList) //use in~ for inclusion or !in~ for exclusion
|
|
| where Toggle !in~ ("/failure:disable", " /success:enable /failure:disable") // use this filter if required to exclude certain toggles
|
|
| project TimeGenerated, Computer, Account, SubjectDomainName, SubjectUserName, Process, ParentProcessName, CommandLine, SubCategory, Toggle
|
|
| extend timestamp = TimeGenerated, AccountName = SubjectUserName, AccountDomain = SubjectDomainName, DeviceName = Computer
|
|
),
|
|
(
|
|
DeviceProcessEvents
|
|
| where TimeGenerated >= ago(timeframe)
|
|
// | where InitiatingProcessFileName =~ "auditpol.exe"
|
|
| where InitiatingProcessCommandLine has_any (tokens)
|
|
| where AccountName !in~ (AccountAllowList)
|
|
| parse InitiatingProcessCommandLine with * "/subcategory:" subcategorytoken
|
|
| extend SubCategory = tostring(split(subcategorytoken, "\"")[1]) , Toggle = tostring(split(subcategorytoken, "\"")[2])
|
|
| where SubCategory in~ (SubCategoryList) //use in~ for inclusion or !in~ for exclusion
|
|
| where Toggle !in~ ("/failure:disable", " /success:enable /failure:disable") // use this filter if required to exclude certain toggles
|
|
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessParentFileName, InitiatingProcessCommandLine, SubCategory, Toggle
|
|
| extend timestamp = TimeGenerated, AccountName = InitiatingProcessAccountName, AccountDomain = InitiatingProcessAccountDomain
|
|
),
|
|
(
|
|
Event
|
|
| where TimeGenerated > ago(timeframe)
|
|
| where Source == "Microsoft-Windows-Sysmon"
|
|
| where EventID == 1
|
|
| extend EventData = parse_xml(EventData).DataItem.EventData.Data
|
|
| mv-expand bagexpansion=array EventData
|
|
| evaluate bag_unpack(EventData)
|
|
| extend Key=tostring(['@Name']), Value=['#text']
|
|
| evaluate pivot(Key, any(Value), TimeGenerated, Source, EventLog, Computer, EventLevel, EventLevelName, EventID, UserName, RenderedDescription, MG, ManagementGroupName, Type, _ResourceId)
|
|
// | where OriginalFileName =~ "auditpol.exe"
|
|
| where CommandLine has_any (tokens)
|
|
| where User !in~ (AccountAllowList)
|
|
| parse CommandLine with * "/subcategory:" subcategorytoken
|
|
| extend SubCategory = tostring(split(subcategorytoken, "\"")[1]) , Toggle = tostring(split(subcategorytoken, "\"")[2])
|
|
| where SubCategory in~ (SubCategoryList) //use in~ for inclusion or !in~ for exclusion
|
|
| where Toggle !in~ ("/failure:disable", " /success:enable /failure:disable") // use this filter if required to exclude certain toggles
|
|
| project TimeGenerated, Computer, User, Process, ParentImage, CommandLine, SubCategory, Toggle
|
|
| extend timestamp = TimeGenerated, AccountName = tostring(split(User, @'\')[1]), AccountUPNSuffix = tostring(split(User, @'\')[0]), DeviceName = Computer
|
|
)
|
|
)
|
|
| extend Account = strcat(AccountDomain, "\\", AccountName)
|
|
entityMappings:
|
|
- entityType: Account
|
|
fieldMappings:
|
|
- identifier: FullName
|
|
columnName: Account
|
|
- identifier: Name
|
|
columnName: AccountName
|
|
- identifier: NTDomain
|
|
columnName: AccountDomain
|
|
- entityType: Host
|
|
fieldMappings:
|
|
- identifier: HostName
|
|
columnName: DeviceName
|
|
version: 1.2.3
|
|
kind: Scheduled
|
|
metadata:
|
|
source:
|
|
kind: Community
|
|
author:
|
|
name: Microsoft Security Research
|
|
support:
|
|
tier: Community
|
|
categories:
|
|
domains: [ "Security - Others" ] |