detection.wiki

Detection rules › Sigma

New member added to an Exchange administration group (medium risk)

Status
experimental
Severity
medium
Log source
product windows, service security
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where a new member is added to a sensitive group related to Exchange server

Known false positives

  • Exchange administrator updating server configuration
  • Exchange upgrade or migration

MITRE ATT&CK coverage

TacticTechniques
Persistence

Telemetry coverage

ProviderRecord / event type
Security-AuditingEvent ID 4728: A member was added to a security-enabled global group.
Security-AuditingEvent ID 4732: A member was added to a security-enabled local group.
Security-AuditingEvent ID 4756: A member was added to a security-enabled universal group.

Rule body

title: New member added to an Exchange administration group (medium risk)
description: Detects scenarios where a new member is added to a sensitive group related to Exchange server
references:
- https://msexchangeguru.com/2015/12/18/rbac-2016/
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1098.xxx-Account%20manipulation
tags:
- attack.persistence
- attack.t1098
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 4728 # security global group member added
      - 4756 # universal group member added
      - 4732 # local and domain local group member added
    TargetUserName:
      - 'Security Reader'
      - 'Exchange View-Only Administrators'
      - 'Organization Management'
      - 'Public Folder Management'
      - 'Recipient Management'
      - 'Records Management'
      - 'Server Management'
      - 'UM Management'
      - 'View-only Organization Management'
  condition: selection
falsepositives:
- Exchange administrator updating server configuration
- Exchange upgrade or migration
level: medium

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  EventID:
    - 4728
    - 4756
    - 4732
  TargetUserName:
    - 'Security Reader'
    - 'Exchange View-Only Administrators'
    - 'Organization Management'
    - 'Public Folder Management'
    - 'Recipient Management'
    - 'Records Management'
    - 'Server Management'
    - 'UM Management'
    - 'View-only Organization Management'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
TargetUserNameeq
  • Exchange View-Only Administrators
  • Organization Management
  • Public Folder Management
  • Recipient Management
  • Records Management
  • Security Reader
  • Server Management
  • UM Management
  • View-only Organization Management
field:"TargetUserName" kind:eq