Exchange group membership change to perform DCsync attack

Status: experimental
Severity: high
Log source: product windows, service security
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker adds its account into a sensitive Exchange group to obtain "Replicating Directory Changes /all" and perform DCsync attack.

Known false positives

Exchange administrator updating server configuration
Exchange upgrade or migration

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003.006` OS Credential Dumping: DCSync

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4728: A member was added to a security-enabled global group.
Security-Auditing	Event ID 4732: A member was added to a security-enabled local group.
Security-Auditing	Event ID 4756: A member was added to a security-enabled universal group.

Rule body

title: Exchange group membership change to perform DCsync attack
description: Detects scenarios where an attacker adds its account into a sensitive Exchange group to obtain "Replicating Directory Changes /all" and perform DCsync attack.
references:
- https://adsecurity.org/?p=4119
- https://pentestlab.blog/2019/09/12/microsoft-exchange-acl/
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access
- https://blog.fox-it.com/2018/04/26/escalating-privileges-with-acls-in-active-directory/
tags:
- attack.credential_access
- attack.t1003.006
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 4728 # security global group member added
      - 4756 # universal group member added > groups below are per default with this group type
      - 4732 # local and domain local group member added
    TargetUserName:
      - 'Exchange Trusted Subsystem'
      - 'Exchange Windows Permissions'
  condition: selection
falsepositives:
- Exchange administrator updating server configuration
- Exchange upgrade or migration
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
  EventID:
    - 4728
    - 4756
    - 4732
  TargetUserName:
    - 'Exchange Trusted Subsystem'
    - 'Exchange Windows Permissions'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetUserName`	eq	`Exchange Trusted Subsystem` `Exchange Windows Permissions`	`field:"TargetUserName" kind:eq`