detection.wiki

Detection rules › Sigma

Exchange group membership change to perform DCsync attack

Status
experimental
Severity
high
Log source
product windows, service security
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker adds its account into a sensitive Exchange group to obtain "Replicating Directory Changes /all" and perform DCsync attack.

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1003.006 OS Credential Dumping: DCSync

Event coverage

ProviderEventTitle
Security-AuditingEvent ID 4728A member was added to a security-enabled global group.
Security-AuditingEvent ID 4732A member was added to a security-enabled local group.
Security-AuditingEvent ID 4756A member was added to a security-enabled universal group.

Rule body yaml

title: Exchange group membership change to perform DCsync attack
description: Detects scenarios where an attacker adds its account into a sensitive Exchange group to obtain "Replicating Directory Changes /all" and perform DCsync attack.
references:
- https://adsecurity.org/?p=4119
- https://pentestlab.blog/2019/09/12/microsoft-exchange-acl/
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access
- https://blog.fox-it.com/2018/04/26/escalating-privileges-with-acls-in-active-directory/
tags:
- attack.credential_access
- attack.t1003.006
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 4728 # security global group member added
      - 4756 # universal group member added > groups below are per default with this group type
      - 4732 # local and domain local group member added
    TargetUserName:
      - 'Exchange Trusted Subsystem'
      - 'Exchange Windows Permissions'
  condition: selection
falsepositives:
- Exchange administrator updating server configuration
- Exchange upgrade or migration
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  EventID:
    - 4728
    - 4756
    - 4732
  TargetUserName:
    - 'Exchange Trusted Subsystem'
    - 'Exchange Windows Permissions'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
TargetUserNameeq
  • Exchange Trusted Subsystem
  • Exchange Windows Permissions