New member added to an "OCS/Lync/Skype for Business" administration group (high risk)

Status: experimental
Severity: high
Log source: product windows, service security
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where a new member is added to a sensitive administration group related to OCS/Lync/Skype for Business in order to scan topology, infiltrate servers and move laterally.

Known false positives

OCS/Lync/Skype administrator updating server configuration or topology
OCS/Lync/Skype upgrade or migration

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1098` Account Manipulation

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4728: A member was added to a security-enabled global group.
Security-Auditing	Event ID 4732: A member was added to a security-enabled local group.
Security-Auditing	Event ID 4756: A member was added to a security-enabled universal group.

Rule body

title: New member added to an "OCS/Lync/Skype for Business" administration group (high risk)
description: Detects scenarios where a new member is added to a sensitive administration group related to OCS/Lync/Skype for Business in order to scan topology, infiltrate servers and move laterally.
references:
- https://docs.microsoft.com/en-us/previous-versions/office/lync-server-2013/lync-server-2013-planning-for-role-based-access-control
- https://docs.microsoft.com/en-us/skypeforbusiness/schema-reference/active-directory-schema-extensions-classes-and-attributes/changes-made-by-forest-preparation
- https://blog.insideo365.com/2012/11/a-lync-administrator-access-refresher/
tags:
- attack.persistence
- attack.t1098
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 4728 # security global group member added
      - 4756 # universal group member added
      - 4732 # local and domain local group member added
    TargetUserName:
      - CSAdministrator
      - CSServerAdministrator
      - RTCUniversalServerAdmins
  condition: selection
falsepositives:
- OCS/Lync/Skype administrator updating server configuration or topology
- OCS/Lync/Skype upgrade or migration
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
  EventID:
    - 4728
    - 4756
    - 4732
  TargetUserName:
    - CSAdministrator
    - CSServerAdministrator
    - RTCUniversalServerAdmins

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetUserName`	eq	`CSAdministrator` `CSServerAdministrator` `RTCUniversalServerAdmins`	`field:"TargetUserName" kind:eq`