Techniques
Sample rules
Windows AD SID History Attribute Modified
- source: splunk
- technicques:
- T1134
- T1134.005
Description
The following analytic detects modifications to the SID History attribute in Active Directory by leveraging event code 5136. This detection uses logs from the wineventlog_security data source to identify changes to the sIDHistory attribute. Monitoring this activity is crucial as the SID History attribute can be exploited by adversaries to inherit permissions from other accounts, potentially granting unauthorized access. If confirmed malicious, this activity could allow attackers to maintain persistent access and escalate privileges within the domain, posing a significant security risk.
Detection logic
`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=sIDHistory OperationType="%%14674"
| stats values(ObjectDN) as ObjectDN by _time, Computer, SubjectUserName, AttributeValue
| rename Computer as dest
| `windows_ad_sid_history_attribute_modified_filter`
Windows AD Cross Domain SID History Addition
- source: splunk
- technicques:
- T1134.005
- T1134
Description
The following analytic detects changes to the sIDHistory attribute of user or computer objects across different domains. It leverages Windows Security Event Codes 4738 and 4742 to identify when the sIDHistory attribute is modified. This activity is significant because the sIDHistory attribute allows users to inherit permissions from other AD accounts, which can be exploited by adversaries for inter-domain privilege escalation and persistence. If confirmed malicious, this could enable attackers to gain unauthorized access to resources, maintain persistence, and escalate privileges across domain boundaries.
Detection logic
`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistory IN ("%%1793", -)
| rex field=SidHistory "(^%{
|^)(?P<SidHistoryMatch>.*)(\-
|\\\)"
| rex field=TargetSid "^(?P<TargetSidmatch>.*)(\-
|\\\)"
| where SidHistoryMatch!=TargetSidmatch AND SidHistoryMatch!=TargetDomainName
| rename TargetSid as userSid
| table _time action status host user userSid SidHistory Logon_ID src_user
| `windows_ad_cross_domain_sid_history_addition_filter`