PROD (TM019.1) - TRUST - A new AD Trust has been established

Status: available
Severity: high
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

A new Trust has been established with the Forest or Domains. The other forest should have a Tier Model deployed.

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1484.002` Domain or Tenant Policy Modification: Trust Modification

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 5137: A directory service object was created.

Rule body

id: 891315d2-e080-4ac8-af5a-50bae17f2d4d
name: 'PROD (TM019.1) - TRUST - A new AD Trust has been established'
description: |
  A new Trust has been established with the Forest or Domains. The other forest should have a Tier Model deployed.
severity: High
requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
  - connectorId: WindowsSecurityEvents
    dataTypes:
      - SecurityEvent
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
status: Available
tactics:
  - PrivilegeEscalation
relevantTechniques:
  - T1484.002
query: |
  SecurityEvent 
  | where EventID == 5137 and EventData has '"ObjectClass">trustedDomain' and EventData has 'CN=System'
  | extend ObjectName = extract("(?i)CN=([^,]+),(?i)CN=System", 1, EventData)
  | extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
  | extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
  | project TimeGenerated
          , ObjectName
          , ActivityType
          , Account
          , Domain
          , Computer
          , Channel
          , EventID
          , EventData
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: ObjectName
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: Computer
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: Account
customDetails:
  ObjectName: ObjectName
  ActivityType: ActivityType
  Account: Account
  Domain: Domain
  Computer: Computer
  Channel: Channel
  EventID: EventID
  EventData: EventData
eventGroupingSettings:
  aggregationKind: AlertPerResult
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
alertDetailsOverride:
  alertDisplayNameFormat: '(TM019.1) A new Trust has been established, ensure the other Forest and Domains have the Tier Model deployed'
  alertDescriptionFormat: 'Ensure the Tier Model has been deployed in the other Forest and Domain. Ensure Trust has been configured and secured properly.'
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

SecurityEvent

Stage 2: `where`

| where EventID == 5137 and EventData has '"ObjectClass">trustedDomain' and EventData has 'CN=System'

Stage 3: `extend` (3 consecutive steps)

| extend ObjectName = extract("(?i)CN=([^,]+),(?i)CN=System", 1, EventData)
| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)

Stage 4: `project`

| project TimeGenerated
        , ObjectName
        , ActivityType
        , Account
        , Domain
        , Computer
        , Channel
        , EventID
        , EventData

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventData`	match	`"ObjectClass">trustedDomain` transforms: `term` `CN=System` transforms: `term`	`field:"EventData" kind:match`
`EventID`	eq	`5137` corpus 14 (splunk 5, kusto 5, elastic 4)	`field:"EventID" kind:eq value:"5137"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Account`	`project`
`ActivityType`	`project`
`Channel`	`project`
`Computer`	`project`
`Domain`	`project`
`EventData`	`project`
`EventID`	`project`
`ObjectName`	`project`
`TimeGenerated`	`project`