Detection rules › Splunk
SharpHound Enumeration (Windows Event Log)
Sharphound can be used to collect Active Directory information in order to easily identify highly complex attack paths that would otherwise be impossible to quickly identify. Once collected information can be utilized by BloodHound to apply graph theory in order to reveal the hidden and often unintended relationships within an Active Directory environment
MITRE ATT&CK coverage
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4799 | A security-enabled local group membership was enumerated. |
Rule body yaml
id: '5529.5745'
title: SharpHound Enumeration
description: 'Sharphound can be used to collect Active Directory information in order
to easily identify highly complex attack paths that would otherwise be impossible
to quickly identify. Once collected information can be utilized by BloodHound to
apply graph theory in order to reveal the hidden and often unintended relationships
within an Active Directory environment. -- Threat Actor Association: APT29/Nobelium/Cozy
Bear, BlackMatter, DarkSide, FIN12, Muddled Libra, UNC2465, Wizard Spider - Software
Association: ALPHV/BlackCat, Bazar, Black Basta, Conti, LockBit, Play, Qakbot/Qbot,
Sodinokibi/REvil, XingLocker -- #TrendingThreat #Russia #Ukraine -- Atomics T1059.001
Test #2 Atomics T1059.001 Test #3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4799) OR
"<EventID>4799<") ((TERM(Remote) (TERM(Management) OR TERM(Desktop)) TERM(Users))
OR TERM(Administrators) OR (TERM(Distributed) TERM(COM) TERM(Users))) | table _time,
host, user process, process_*, parent_process_*, signature_id, user_group | bin
span=5s | stats values(*) as * by _time, host | eventstats dc(user_group) as dc_user_group
by host, user, _time | eventstats c(process_name) as c_process_name by process_name
|where dc_user_group=4 or c_process_name < 10 '
techniques:
- discovery:account discovery:domain account
- discovery:permission groups discovery:domain groups
- discovery:account discovery:local account
- discovery:system information discovery
- execution:command and scripting interpreter:windows command shell
- discovery:domain trust discovery
- discovery:password policy discovery
- discovery:permission groups discovery:local groups
technique_id:
- T1087.002
- T1069.002
- T1087.001
- T1082
- T1059.003
- T1482
- T1201
- T1069.001
data_category:
- Windows event logs
references:
- https://medium.com/securonix-tech-blog/detecting-ldap-enumeration-and-bloodhound-s-sharphound-collector-using-active-directory-decoys-dfc840f2f644
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4799) OR "<EventID>4799<") ((TERM(Remote) (TERM(Management) OR TERM(Desktop)) TERM(Users)) OR TERM(Administrators) OR (TERM(Distributed) TERM(COM) TERM(Users)))
Stage 2: table
| table _time, host, user process, process_*, parent_process_*, signature_id, user_group
Stage 3: bucket
| bin span=5s
Stage 4: stats
| stats values(*) as * by _time, host
Stage 5: eventstats
| eventstats dc(user_group) as dc_user_group by host, user, _time
Stage 6: eventstats
| eventstats c(process_name) as c_process_name by process_name
Stage 7: where
| where dc_user_group=4 or c_process_name < 10
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
c_process_name | lt |
|
dc_user_group | eq |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4799<" |
| 1 | TERM |
| 1 | Remote |
| 1 | TERM |
| 1 | Management |
| 1 | TERM |
| 1 | Desktop |
| 1 | TERM |
| 1 | Users |
| 1 | TERM |
| 1 | Administrators |
| 1 | TERM |
| 1 | Distributed |
| 1 | TERM |
| 1 | COM |
| 1 | TERM |
| 1 | Users |