PROD (TM017.1) - GROUP - Tier 0 Added to Allow RODC Password Replication Group

id: 634a69b4-0e46-4349-8463-af1c8d191620
name: 'PROD (TM017.1) - GROUP - Tier 0 Added to Allow RODC Password Replication Group'
description: |
  Adding a Tier 0 object to the Allow RODC Password Replication Group.
severity: High
requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
  - connectorId: WindowsSecurityEvents
    dataTypes:
      - SecurityEvent
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
status: Available
tactics:
  - PrivilegeEscalation
relevantTechniques:
  - T1078.002
query: |
  SecurityEvent 
  | where EventID == 5136
      and Activity has "modified"
      and EventData matches regex "(?i)CN=Allowed RODC Password Replication Group,CN=Users"
      and EventData has '"AttributeLDAPDisplayName">member'
      and EventData has 'OperationType">%%14674'
  | extend GroupName_e = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
  | extend GroupName = extract("(?i)CN=([^,]+)", 1, GroupName_e)
  | extend ObjectName_e = extract("<Data Name=\"AttributeValue\">([^<]+)</Data>", 1, EventData)
  | extend ObjectName = extract("(?i)CN=([^,]+)", 1, ObjectName_e)
  | extend ObjectTier_e = extract("<Data Name=\"AttributeValue\">([^<]+)</Data>", 1, EventData)
  | extend ObjectTier = case(
      ObjectName_e has "Tier 0", "Tier 0",
      ObjectName_e has "Tier 1", "Tier 1",
      ObjectName_e has "Tier 2", "Tier 2",
      "Outside Tier Model")
  | where ObjectTier == "Tier 0"
  | extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
  | extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
  | extend SubjectUserName = extract("<Data Name=\"SubjectUserName\">([^<]+)</Data>", 1, EventData)
  | extend SubjectDomainName = extract("<Data Name=\"SubjectDomainName\">([^<]+)</Data>", 1, EventData)
  | extend Account = strcat(SubjectDomainName, "\\", SubjectUserName)
  | extend OperationType = iff(EventData has 'OperationType">%%14674', "Added", tostring(OperationType))
  | project TimeGenerated 
          , ObjectName
          , ObjectTier
          , ObjectType = AccountType
          , GroupName
          , ActivityType
          , OperationType
          , Account
          , Domain
          , Computer
          , Channel
          , EventID
          , EventData
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: ObjectName
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: GroupName
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: Computer
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: Account
customDetails:
  ObjectName: ObjectName
  ObjectTier: ObjectTier
  ObjectType: ObjectType
  GroupName: GroupName
  ActivityType: ActivityType
  OperationType: OperationType
  Account: Account
  Domain: Domain
  Computer: Computer
  Channel: Channel
  EventID: EventID
  EventData: EventData
eventGroupingSettings:
  aggregationKind: AlertPerResult
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
alertDetailsOverride:
  alertDisplayNameFormat: '(TM017.1) A Tier 0 member was added to the Allow RODC Password Replication Group'
  alertDescriptionFormat: 'The following Tier 0 {{ObjectName}} object was added to the Allow RODC Password Replication Group.'
version: 1.0.0
kind: Scheduled