Privileged Domain Group Enumeration via LDAP

[rule]
description = """
Identifies Active Directory privileged groups enumeration using LDAP search events. Adversaries attempt to enumerate
groups with sensitive permissions to further escalate privileges.
"""
id = "c709fe69-b699-4498-b858-eb6afcfd17ab"
license = "Elastic License v2"
name = "Privileged Domain Group Enumeration via LDAP"
os_list = ["windows"]
version = "1.0.4"

query = '''
api where process.Ext.api.name == "ldap_search" and
 (
 (process.Ext.api.parameters.search_filter : ("objectClass=?", "(objectClass=?)") and
  process.Ext.api.parameters.distinguished_name :
                            ("cn=domain admins*", "cn=enterprise admins*", "cn=dnsadmins*", "cn=cloneable domain controllers",
                             "cn=read-only domain controllers", "cn=exchange organization administrators*",
                             "cn=backup admins*", "cn=group policy creator owners*", "cn=domain controllers*")) or
  (process.Ext.api.parameters.search_filter : "*(objectClass=user)(memberof*" and process.Ext.api.parameters.search_filter : "*Admin*")
  ) and
  not process.executable : "C:\\Program Files\\Semperis\\Management Server\\Semperis.TaskServerSvcHost.exe"
'''

min_endpoint_version = "9.1.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1069"
name = "Permission Groups Discovery"
reference = "https://attack.mitre.org/techniques/T1069/"
[[threat.technique.subtechnique]]
id = "T1069.002"
name = "Domain Groups"
reference = "https://attack.mitre.org/techniques/T1069/002/"


[[threat.technique]]
id = "T1087"
name = "Account Discovery"
reference = "https://attack.mitre.org/techniques/T1087/"
[[threat.technique.subtechnique]]
id = "T1087.002"
name = "Domain Account"
reference = "https://attack.mitre.org/techniques/T1087/002/"



[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[internal]
min_endpoint_version = "9.1.0"