detection.wiki

Detection rules › Sigma

OCSP responder security settings changed

Status
experimental
Severity
high
Log source
product windows, service security
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker would attempt to escalate privileges by changing the security settings of the responder.

MITRE ATT&CK coverage

TacticTechniques
Defense ImpairmentT1222 File and Directory Permissions Modification

Event coverage

ProviderEventTitle
Security-AuditingEvent ID 5124A security setting was updated on OCSP Responder Service.

Rule body yaml

title: OCSP responder security settings changed
description: Detects scenarios where an attacker would attempt to escalate privileges by changing the security settings of the responder.
requirements: requires to have the OCSP role installed and to have enabled auditing in the responder properties.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1222.001-File%20and%20Directory%20Permissions%20Modification
- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=5124
tags:
- attack.defense_evasion
- attack.t1222
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5124
  condition: selection
falsepositives:
- Rare PKI/ADCS/OSCP admin changes
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  EventID: 5124