AD Certificate Services Enumeration via LDAP

[rule]
description = """
Identifies a list of LDAP queries used to enumerate Active Directory Certificate Services as a preparation step to
identify potential AD Certificate Service attack paths.
"""
id = "d5c1ecae-c25a-4ad5-b9e8-3d4fa8ffa25f"
license = "Elastic License v2"
name = "AD Certificate Services Enumeration via LDAP"
os_list = ["windows"]
reference = ["https://posts.specterops.io/bofhound-ad-cs-integration-91b706bc7958"]
version = "1.0.3"

query = '''
api where process.Ext.api.name == "ldap_search" and
 process.Ext.api.parameters.attribute_list == "ntsecuritydescriptor" and
 process.Ext.api.parameters.distinguished_name like "*cn=configuration*" and
 process.Ext.api.parameters.search_filter : (
  "(objectclass=pKIEnrollmentService)",
  "(objectclass=certificationAuthority)",
  "(objectclass=pKICertificateTemplate)",
  "(objectclass=msPKI-Enterprise-Oid)"
  ) and
  not (process.code_signature.subject_name == "Netwrix Corporation" and process.code_signature.trusted == true) and 
  not process.executable :
             ("?:\\Program Files\\Azure Advanced Threat Protection Sensor\\*\\Microsoft.Tri.Sensor.exe",
              "?:\\Windows\\System32\\lsass.exe",
              "?:\\Windows\\ADFS\\Microsoft.IdentityServer.ServiceHost.exe",
              "?:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe",
              "?:\\Program Files\\Semperis\\Management Server\\Semperis.TaskServerSvcHost.exe")
'''

min_endpoint_version = "9.1.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1069"
name = "Permission Groups Discovery"
reference = "https://attack.mitre.org/techniques/T1069/"
[[threat.technique.subtechnique]]
id = "T1069.002"
name = "Domain Groups"
reference = "https://attack.mitre.org/techniques/T1069/002/"


[[threat.technique]]
id = "T1087"
name = "Account Discovery"
reference = "https://attack.mitre.org/techniques/T1087/"
[[threat.technique.subtechnique]]
id = "T1087.002"
name = "Domain Account"
reference = "https://attack.mitre.org/techniques/T1087/002/"


[[threat.technique]]
id = "T1482"
name = "Domain Trust Discovery"
reference = "https://attack.mitre.org/techniques/T1482/"


[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[internal]
min_endpoint_version = "9.1.0"