New EXE deployed via Default Domain or Default Domain Controller Policies

Status: available
Severity: high
Time window: 14d
Group by: CommandLine, Computer, NewProcessName, Process
Source: github.com/Azure/Azure-Sentinel

This detection highlights executables deployed to hosts via either the Default Domain or Default Domain Controller Policies. These policies apply to all hosts or Domain Controllers and best practice is that these policies should not be used for deployment of files. A threat actor may use these policies to deploy files or scripts to all hosts in a domain.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1072` Software Deployment Tools
Lateral Movement	`T1072` Software Deployment Tools `T1570` Lateral Tool Transfer

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

id: 05b4bccd-dd12-423d-8de4-5a6fb526bb4f
name: New EXE deployed via Default Domain or Default Domain Controller Policies
description: |
  'This detection highlights executables deployed to hosts via either the Default Domain or Default Domain Controller Policies. These policies apply to all hosts or Domain Controllers and best practice is that these policies should not be used for deployment of files.
  A threat actor may use these policies to deploy files or scripts to all hosts in a domain.'
severity: High
requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
  - connectorId: WindowsSecurityEvents
    dataTypes:
      - SecurityEvent
queryFrequency: 1d
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
status: Available
tactics:
  - Execution
  - LateralMovement
relevantTechniques:
  - T1072
  - T1570
query: |
  let known_processes = (
    SecurityEvent
    // If adjusting Query Period or Frequency update these
    | where TimeGenerated between(ago(14d)..ago(1d))
    | where EventID == 4688
    | where NewProcessName has_any ("Policies\\{6AC1786C-016F-11D2-945F-00C04fB984F9}", "Policies\\{31B2F340-016D-11D2-945F-00C04FB984F9}")
    | summarize by Process);
    SecurityEvent
    // If adjusting Query Period or Frequency update these
    | where TimeGenerated > ago(1d)
    | where EventID == 4688
    | where NewProcessName has_any ("Policies\\{6AC1786C-016F-11D2-945F-00C04fB984F9}", "Policies\\{31B2F340-016D-11D2-945F-00C04FB984F9}")
    | where Process !in (known_processes)
    // This will likely apply to multiple hosts so summarize these data
    | summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by Process, NewProcessName, CommandLine, Computer
    | extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
    | extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: Computer
      - identifier: HostName
        columnName: HostName
      - identifier: DnsDomain
        columnName: HostNameDomain
version: 1.0.2
kind: Scheduled

Stages and Predicates

Let binding: `known_processes` used in Stage 5

let known_processes = (
  SecurityEvent
  | where TimeGenerated between(ago(14d)..ago(1d))
  | where EventID == 4688
  | where NewProcessName has_any ("Policies\\{6AC1786C-016F-11D2-945F-00C04fB984F9}", "Policies\\{31B2F340-016D-11D2-945F-00C04FB984F9}")
  | summarize by Process);

Stage 1: `source`

SecurityEvent

Stage 2: `where`

where TimeGenerated > ago(86400s)

Stage 3: `where`

where EventID == 4688

Stage 4: `where`

where (NewProcessName contains @"Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}" or NewProcessName contains @"Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}")

Stage 5: `where`

where not (Process =~ "known_processes")

Stage 6: `summarize`

summarize FirstSeen, LastSeen by Process, NewProcessName, CommandLine, Computer

Stage 7: `extend`

extend DomainIndex, HostName

Stage 8: `extend`

extend HostNameDomain

HostNameDomain =

ifDomainIndex != -1substring(Computer, (DomainIndex + 1))

elseComputer

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Process`	eq	`known_processes`	`excludes:Process` `field:"Process" value:"known_processes"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventID`	eq	`4688` corpus 317 (splunk 283, kusto 33, elastic 1)	`field:"EventID" kind:eq value:"4688"`
`NewProcessName`	match	`Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}` transforms: `term` `Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}` transforms: `term`	`field:"Image" kind:match`

Output fields

These fields are emitted when the rule matches.

Field	Source
`CommandLine`	`summarize`
`Computer`	`summarize`
`FirstSeen`	`summarize`
`LastSeen`	`summarize`
`NewProcessName`	`summarize`
`Process`	`summarize`
`DomainIndex`	`extend`
`HostName`	`extend`
`HostNameDomain`	`extend`

New EXE deployed via Default Domain or Default Domain Controller Policies

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Let binding: known_processes used in Stage 5

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: where

Stage 6: summarize

Stage 7: extend

Stage 8: extend