76 строки
4.1 KiB
YAML
76 строки
4.1 KiB
YAML
id: bac44fe4-c0bc-4e90-aa48-2e346fda803f
|
|
name: Tracking Password Changes
|
|
description: |
|
|
'Identifies when a password change or reset occurs across multiple host and cloud based sources.
|
|
Account manipulation including password changes and resets may aid adversaries in maintaining access to credentials
|
|
and certain permission levels within an environment.'
|
|
requiredDataConnectors:
|
|
- connectorId: AzureActiveDirectory
|
|
dataTypes:
|
|
- AuditLogs
|
|
- connectorId: SecurityEvents
|
|
dataTypes:
|
|
- SecurityEvent
|
|
- connectorId: Syslog
|
|
dataTypes:
|
|
- Syslog
|
|
- connectorId: Office365
|
|
dataTypes:
|
|
- OfficeActivity
|
|
- connectorId: AzureActiveDirectory
|
|
dataTypes:
|
|
- SigninLogs
|
|
- connectorId: WindowsSecurityEvents
|
|
dataTypes:
|
|
- SecurityEvents
|
|
- connectorId: WindowsForwardedEvents
|
|
dataTypes:
|
|
- WindowsEvent
|
|
tactics:
|
|
- InitialAccess
|
|
- CredentialAccess
|
|
relevantTechniques:
|
|
- T1078
|
|
- T1110
|
|
query: |
|
|
|
|
let action = dynamic(["change ", "changed ", "reset "]);
|
|
let pWord = dynamic(["password ", "credentials "]);
|
|
(union isfuzzy=true
|
|
(SecurityEvent
|
|
| where EventID in (4723,4724)
|
|
| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), ResultDescriptions = makeset(Activity), ActionCount = count() by Resource = Computer, OperationName = strcat("TargetAccount: ", TargetUserName), UserId = Account, Type
|
|
),
|
|
(WindowsEvent
|
|
| where EventID in (4723,4724)
|
|
| extend Activity=iff(EventID=='4723',"4723 - An attempt was made to change an account","4724 - An attempt was made to reset an account")
|
|
| extend TargetUserName = tostring(EventData.TargetUserName)
|
|
| extend Account = strcat(tostring(EventData.SubjectDomainName),"\\", tostring(EventData.SubjectUserName))
|
|
| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), ResultDescriptions = makeset(Activity), ActionCount = count() by Resource = Computer, OperationName = strcat("TargetAccount: ", TargetUserName), UserId = Account, Type
|
|
),
|
|
(AuditLogs
|
|
| where OperationName has_any (pWord) and OperationName has_any (action)
|
|
| extend InitiatedBy = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)
|
|
| extend TargetUserPrincipalName = tostring(TargetResources[0].userPrincipalName)
|
|
| where ResultDescription != "None"
|
|
| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), ResultDescriptions = makeset(ResultDescription), CorrelationIds = makeset(CorrelationId), ActionCount = count() by OperationName = strcat(Category, " - ", OperationName, " - ", Result), Resource, UserId = TargetUserPrincipalName, Type
|
|
| extend ResultDescriptions = tostring(ResultDescriptions)
|
|
),
|
|
(OfficeActivity
|
|
| where (ExtendedProperties has_any (pWord) or ModifiedProperties has_any (pWord)) and (ExtendedProperties has_any (action) or ModifiedProperties has_any (action))
|
|
| extend ResultDescriptions = case(
|
|
OfficeWorkload =~ "AzureActiveDirectory", tostring(ExtendedProperties),
|
|
OfficeWorkload has_any ("Exchange","OneDrive"), OfficeObjectId,
|
|
RecordType)
|
|
| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), ResultDescriptions = makeset(ResultDescriptions), ActionCount = count() by Resource = OfficeWorkload, OperationName = strcat(Operation, " - ", ResultStatus), IPAddress = ClientIP, UserId, Type
|
|
),
|
|
(Syslog
|
|
| where SyslogMessage has_any (pWord) and SyslogMessage has_any (action)
|
|
| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), ResultDescriptions = makeset(SyslogMessage), ActionCount = count() by Resource = HostName, OperationName = Facility , IPAddress = HostIP, ProcessName, Type
|
|
),
|
|
(SigninLogs
|
|
| where OperationName =~ "Sign-in activity" and ResultType has_any ("50125", "50133")
|
|
| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), ResultDescriptions = makeset(ResultDescription), CorrelationIds = makeset(CorrelationId), ActionCount = count() by Resource, OperationName = strcat(OperationName, " - ", ResultType), IPAddress, UserId = UserPrincipalName, Type
|
|
)
|
|
)
|
|
| extend timestamp = StartTimeUtc, AccountCustomEntity = UserId, IPCustomEntity = IPAddress |