detection.wiki

Detection rules › Sigma

DSRM password changed (native)

Status
experimental
Severity
high
Log source
product windows, service security
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker reset or synchronize with another domain account the DSRM (Directory Services Restore Mode) password in order to escalate privileges.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1098 Account Manipulation

Event coverage

ProviderEventTitle
Security-AuditingEvent ID 4794An attempt was made to set the Directory Services Restore Mode administrator password.

Rule body yaml

title: DSRM password changed (native)
description: Detects scenarios where an attacker reset or synchronize with another domain account the DSRM (Directory Services Restore Mode) password in order to escalate privileges.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1003-Credential%20dumping
- https://adsecurity.org/?p=1714
- https://adsecurity.org/?p=1785
- https://book.hacktricks.xyz/windows/active-directory-methodology/dsrm-credentials
- https://www.hackingarticles.in/domain-persistence-dsrm/
- https://azurecloudai.blog/2020/06/19/how-to-reset-the-directory-service-restore-mode-dsrm-password/
tags:
- attack.persistence
- attack.t1098
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection: # full command: NTDSUTIL >> set dsrm password >> reset password on server null >> <password>
  selection:
    EventID: 4794
  condition: selection
falsepositives:
- Disaster recovery situation
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  EventID: 4794