Certified Pre-Owned - backup of CA private key - rule 2

Status: available
Severity: medium
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

This query identifies someone that performs a backup of they CA key.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1036` Masquerading

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 5059: Key migration operation.

Rule body

id: 88f8fbc0-345d-458e-85f6-f73921d5ef50
name: Certified Pre-Owned - backup of CA private key - rule 2
description: |
  This query identifies someone that performs a backup of they CA key.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
  - connectorId: WindowsSecurityEvents
    dataTypes:
      - SecurityEvent
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - DefenseEvasion
relevantTechniques:
  - T1036
query: |
  SecurityEvent
  // Fill in the machine name of your CA.
  | where EventID == 5059 and Computer contains "<YOUR CA MACHINE NAME>"
  | where EventData contains "%%2499" and EventData contains "%%2464"
  | extend EventData=parse_xml(EventData)
  | mv-apply d=EventData.EventData.Data on
  (
      where d["@Name"]=="KeyName"
      | project KeyName=tostring(d["#text"])
  )
  | mv-apply d=EventData.EventData.Data on
  (
      where d["@Name"]=="SubjectUserName"
      | project SubjectUserName=tostring(d["#text"])
  )
  | parse Account with "<YOUR DOMAIN NAME>\\" CleanAccount "$"
  | where not(Computer startswith CleanAccount)
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: Computer
version: 1.0.1
kind: Scheduled

Stages and Predicates

Stage 1: `source`

SecurityEvent

Stage 2: `where`

| where EventID == 5059 and Computer contains "<YOUR CA MACHINE NAME>"

Stage 3: `where`

| where EventData contains "%%2499" and EventData contains "%%2464"

Stage 4: `extend`

| extend EventData=parse_xml(EventData)

Stage 5: `kusto:mv-apply`

| mv-apply d=EventData.EventData.Data on
(
    where d["@Name"]=="KeyName"
    | project KeyName=tostring(d["#text"])
)

Stage 6: `kusto:mv-apply`

| mv-apply d=EventData.EventData.Data on
(
    where d["@Name"]=="SubjectUserName"
    | project SubjectUserName=tostring(d["#text"])
)

Stage 7: `parse`

| parse Account with "<YOUR DOMAIN NAME>\\" CleanAccount "$"

Stage 8: `where`

| where not(Computer startswith CleanAccount)

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Computer`	starts_with	`CleanAccount`	`excludes:Computer` `field:"Computer" value:"CleanAccount"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`@Name`	eq	`KeyName` corpus 2 (kusto 2) `SubjectUserName` corpus 2 (kusto 2)	`field:"@Name" kind:eq`
`Computer`	contains	`<YOUR CA MACHINE NAME>` corpus 2 (kusto 2)	`field:"Computer" kind:contains value:"<YOUR CA MACHINE NAME>"`
`EventData`	contains	`%%2464` `%%2499` corpus 2 (kusto 2)	`field:"EventData" kind:contains`
`EventID`	eq	`5059`	`field:"EventID" kind:eq value:"5059"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`EventData`	`extend`

Certified Pre-Owned - backup of CA private key - rule 2

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: extend

Stage 5: kusto:mv-apply

Stage 6: kusto:mv-apply

Stage 7: parse

Stage 8: where