detection.wiki

Detection rules › Kusto

PROD (TM002.1) - OBJECT - Created or Deleted a Tier Level Object

Status
available
Severity
low
Time window
30m
Source
github.com/Azure/Azure-Sentinel

A Tier Model object was created or deleted

MITRE ATT&CK coverage

TacticTechniques
Initial Access

Telemetry coverage

ProviderRecord / event type
Security-AuditingEvent ID 5137: A directory service object was created.
Security-AuditingEvent ID 5141: A directory service object was deleted.

Rule body

id: b58adf25-fb44-4296-9b6c-0e6b97139dad
name: 'PROD (TM002.1) - OBJECT - Created or Deleted a Tier Level Object'
description: |
  A Tier Model object was created or deleted
severity: Low
requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
  - connectorId: WindowsSecurityEvents
    dataTypes:
      - SecurityEvent
queryFrequency: 30m
queryPeriod: 30m
triggerOperator: gt
triggerThreshold: 0
status: Available
tactics:
  - InitialAccess
relevantTechniques:
  - T1078.002
query: |
  SecurityEvent 
  | where (EventID == 5137
      or EventID == 5141)
      and (EventData matches regex @"(?i)OU=Domain Controllers"
          or EventData matches regex @"(?i)OU=Tier 0 Accounts" 
          or EventData matches regex @"(?i)OU=Tier 1 Accounts" 
          or EventData matches regex @"(?i)OU=Tier 2 Accounts"
          or EventData matches regex @"(?i)OU=Tier 0 Service Accounts" 
          or EventData matches regex @"(?i)OU=Tier 1 Service Accounts" 
          or EventData matches regex @"(?i)OU=Tier 2 Service Accounts"
          or EventData matches regex @"(?i)OU=Tier 0 Groups"
          or EventData matches regex @"(?i)OU=Tier 1 Groups"
          or EventData matches regex @"(?i)OU=Tier 2 Groups"
          or EventData matches regex @"(?i)OU=Tier 0 PAW"
          or EventData matches regex @"(?i)OU=Tier 1 PAW"
          or EventData matches regex @"(?i)OU=Tier 2 PAW"
          or EventData matches regex @"(?i)OU=Tier 0 Member Servers"
          or EventData matches regex @"(?i)OU=Tier 1 Member Servers"
          or EventData matches regex @"(?i)CN=Builtin"
          or EventData matches regex @"(?i)CN=Computers"
          or EventData matches regex @"(?i)CN=Users")
  | extend ObjectName_e = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
  | extend ObjectName = extract("(?i)CN=([^,]+)", 1, ObjectName_e)
  | extend ObjectTier_e = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
  | extend ObjectTier = extract("(?i)OU=(Tier [^ ,]+)", 1, ObjectTier_e)
  | extend ObjectTier = iff(ObjectTier == "", "Outside Tier Model", ObjectTier)
  | extend ObjectTier = iff(ObjectTier_e has "OU=Domain Controllers", "Tier 0", ObjectTier)
  | extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
  | where ObjectClass !has "organizationalUnit" and ObjectClass !has "msFVE-RecoveryInformation"
  | extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
  | extend SubjectUserName = extract("<Data Name=\"SubjectUserName\">([^<]+)</Data>", 1, EventData)
  | extend SubjectDomainName = extract("<Data Name=\"SubjectDomainName\">([^<]+)</Data>", 1, EventData)
  | extend Account = strcat(SubjectDomainName, "\\", SubjectUserName)
  | extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
  | project TimeGenerated
          , ObjectName
          , ObjectTier
          , ObjectClass
          , ActivityType
          , Account
          , Domain
          , Computer
          , Channel
          , EventID
          , EventData
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: ObjectName
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: Computer
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: Account
customDetails:
  ObjectName: ObjectName
  ObjectTier: ObjectTier
  ObjectClass: ObjectClass
  ActivityType: ActivityType
  Account: Account
  Domain: Domain
  Computer: Computer
  Channel: Channel
  EventID: EventID
  EventData: EventData
eventGroupingSettings:
  aggregationKind: AlertPerResult
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5M
    matchingMethod: Selected
    groupByEntities:
      - Account
    groupByCustomDetails:
      - ObjectName
alertDetailsOverride:
  alertDisplayNameFormat: '(TM002.1) A {{ObjectTier}} {{ObjectClass}} was {{ActivityType}}'
  alertDescriptionFormat: 'Tier Model TM002 - A Tier Model object was created or deleted.'
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: source

SecurityEvent

Stage 2: where

| where (EventID == 5137
    or EventID == 5141)
    and (EventData matches regex @"(?i)OU=Domain Controllers"
        or EventData matches regex @"(?i)OU=Tier 0 Accounts" 
        or EventData matches regex @"(?i)OU=Tier 1 Accounts" 
        or EventData matches regex @"(?i)OU=Tier 2 Accounts"
        or EventData matches regex @"(?i)OU=Tier 0 Service Accounts" 
        or EventData matches regex @"(?i)OU=Tier 1 Service Accounts" 
        or EventData matches regex @"(?i)OU=Tier 2 Service Accounts"
        or EventData matches regex @"(?i)OU=Tier 0 Groups"
        or EventData matches regex @"(?i)OU=Tier 1 Groups"
        or EventData matches regex @"(?i)OU=Tier 2 Groups"
        or EventData matches regex @"(?i)OU=Tier 0 PAW"
        or EventData matches regex @"(?i)OU=Tier 1 PAW"
        or EventData matches regex @"(?i)OU=Tier 2 PAW"
        or EventData matches regex @"(?i)OU=Tier 0 Member Servers"
        or EventData matches regex @"(?i)OU=Tier 1 Member Servers"
        or EventData matches regex @"(?i)CN=Builtin"
        or EventData matches regex @"(?i)CN=Computers"
        or EventData matches regex @"(?i)CN=Users")

Stage 3: extend (7 consecutive steps)

| extend ObjectName_e = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
| extend ObjectName = extract("(?i)CN=([^,]+)", 1, ObjectName_e)
| extend ObjectTier_e = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
| extend ObjectTier = extract("(?i)OU=(Tier [^ ,]+)", 1, ObjectTier_e)
| extend ObjectTier = iff(ObjectTier == "", "Outside Tier Model", ObjectTier)
| extend ObjectTier = iff(ObjectTier_e has "OU=Domain Controllers", "Tier 0", ObjectTier)
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)

Stage 4: where

| where ObjectClass !has "organizationalUnit" and ObjectClass !has "msFVE-RecoveryInformation"

Stage 5: extend (5 consecutive steps)

| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
| extend SubjectUserName = extract("<Data Name=\"SubjectUserName\">([^<]+)</Data>", 1, EventData)
| extend SubjectDomainName = extract("<Data Name=\"SubjectDomainName\">([^<]+)</Data>", 1, EventData)
| extend Account = strcat(SubjectDomainName, "\\", SubjectUserName)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)

Stage 6: project

| project TimeGenerated
        , ObjectName
        , ObjectTier
        , ObjectClass
        , ActivityType
        , Account
        , Domain
        , Computer
        , Channel
        , EventID
        , EventData

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
ObjectClassmatchmsFVE-RecoveryInformationexcludes:ObjectClass field:"ObjectClass" value:"msFVE-RecoveryInformation"
ObjectClassmatchorganizationalUnitexcludes:ObjectClass field:"ObjectClass" value:"organizationalUnit"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
EventDataregex_match
  • (?i)CN=Builtin
  • (?i)CN=Computers
  • (?i)CN=Users
  • (?i)OU=Domain Controllers corpus 8 (kusto 8)
  • (?i)OU=Tier 0 Accounts corpus 4 (kusto 4)
  • (?i)OU=Tier 0 Groups corpus 3 (kusto 3)
  • (?i)OU=Tier 0 Member Servers corpus 8 (kusto 8)
  • (?i)OU=Tier 0 PAW corpus 6 (kusto 6)
  • (?i)OU=Tier 0 Service Accounts corpus 4 (kusto 4)
  • (?i)OU=Tier 1 Accounts corpus 4 (kusto 4)
  • (?i)OU=Tier 1 Groups corpus 3 (kusto 3)
  • (?i)OU=Tier 1 Member Servers corpus 8 (kusto 8)
  • (?i)OU=Tier 1 PAW corpus 6 (kusto 6)
  • (?i)OU=Tier 1 Service Accounts corpus 4 (kusto 4)
  • (?i)OU=Tier 2 Accounts corpus 4 (kusto 4)
  • (?i)OU=Tier 2 Groups corpus 3 (kusto 3)
  • (?i)OU=Tier 2 PAW corpus 6 (kusto 6)
  • (?i)OU=Tier 2 Service Accounts corpus 4 (kusto 4)
field:"EventData" kind:regex_match
EventIDeq
  • 5137 corpus 14 (splunk 5, kusto 5, elastic 4)
  • 5141 corpus 4 (splunk 2, kusto 2)
field:"EventID" kind:eq

Output fields

These fields are emitted when the rule matches.

FieldSource
Accountproject
ActivityTypeproject
Channelproject
Computerproject
Domainproject
EventDataproject
EventIDproject
ObjectClassproject
ObjectNameproject
ObjectTierproject
TimeGeneratedproject