Access to a Sensitive LDAP Attribute

edit

Identify access to sensitive Active Directory object attributes that contains credentials and decryption keys such as unixUserPassword, ms-PKI-AccountCredentials and msPKI-CredentialRoamingTokens.

Rule type: eql

Rule indices:

  • winlogbeat-*
  • logs-system.*

Severity: medium

Risk score: 47

Runs every: 5 minutes

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Elastic
  • Host
  • Windows
  • Threat Detection
  • Credential Access
  • Active Directory

Version: 1

Added (Elastic Stack release): 8.6.0

Rule authors: Elastic

Rule license: Elastic License v2

Investigation guide

edit
The 'Audit Directory Service Changes' logging policy must be configured for (Success, Failure).
Steps to implement the logging policy with Advanced Audit Configuration:

```
Computer Configuration >
Policies >
Windows Settings >
Security Settings >
Advanced Audit Policies Configuration >
Audit Policies >
DS Access >
Audit Directory Service Changes (Success,Failure)
```

Rule query

edit
any where event.action == "Directory Service Access" and event.code ==
"4662" and not winlog.event_data.SubjectUserSid : "S-1-5-18" and
winlog.event_data.Properties : ( /* unixUserPassword */
"*612cb747-c0e8-4f92-9221-fdd5f15b550d*", /* ms-PKI-
AccountCredentials */ "*b8dfa744-31dc-4ef1-ac7c-84baf7ef9da7*",
/* ms-PKI-DPAPIMasterKeys */
"*b3f93023-9239-4f7c-b99c-6745d87adbc2*", /* msPKI-
CredentialRoamingTokens */ "*b7ff5a38-0818-42b0-8110-d3d154c97f24*"
)

Threat mapping

edit

Framework: MITRE ATT&CKTM