detection.wiki

Detection rules › Sigma

Active Directory honeypot enumerated by a suspicious host (Bloodhound)

Status
experimental
Severity
high
Log source
product windows, service security
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker is attempting to discover sensitive accounts using tools like Bloodhound. To find out the source of the enumeration, correlate the SubjectLogonId from ID 4662 with TargetLogonId from ID 4624.

MITRE ATT&CK coverage

TacticTechniques
DiscoveryT1087 Account Discovery

Event coverage

ProviderEventTitle
Security-AuditingEvent ID 4662An operation was performed on an object.

Rule body yaml

title: Active Directory honeypot enumerated by a suspicious host (Bloodhound)
description: Detects scenarios where an attacker is attempting to discover sensitive accounts using tools like Bloodhound. To find out the source of the enumeration, correlate the SubjectLogonId from ID 4662 with TargetLogonId from ID 4624.
requirements: ensure that those accounts are "attractive", documented, do not create any breach and cannot be used against your organization. Moreover, specific SACL for "Everyone" with "ReadProperties" need to be configured on each honeypot object.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0007-Discovery/T1087-Account%20discovery
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662
- http://www.labofapenetrationtester.com/2018/10/deploy-deception.html
- https://jblog.javelin-networks.com/blog/the-honeypot-buster/
tags:
- attack.discovery
- attack.t1087
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4662
    ObjectName: '%honeypot_guid_list%' # GUID of pre-configured honeypot object(s). Eg: '%{259162f1-58e4-4ee9-9b9c-2baf2a03d376}'
  condition: selection
falsepositives:
- LDAP explorer tools, pentest
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  EventID: 4662
  ObjectName: '%honeypot_guid_list%'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ObjectNameeq
  • %honeypot_guid_list%