83 lines
2.9 KiB
YAML
83 lines
2.9 KiB
YAML
|
|
title: LDAP Reconnaissance / Active Directory Enumeration
|
|
author: Adeem Mawani
|
|
date: 2021/06/22
|
|
description: Detects possible Active Directory enumeration via LDAP
|
|
detection:
|
|
SELECTION_1:
|
|
EventID: 30
|
|
SELECTION_2:
|
|
SearchFilter:
|
|
- '*(groupType:1.2.840.113556.1.4.803:=2147483648)*'
|
|
- '*(groupType:1.2.840.113556.1.4.803:=2147483656)*'
|
|
- '*(groupType:1.2.840.113556.1.4.803:=2147483652)*'
|
|
- '*(groupType:1.2.840.113556.1.4.803:=2147483650)*'
|
|
- '*(sAMAccountType=805306369)*'
|
|
- '*(sAMAccountType=805306368)*'
|
|
- '*(sAMAccountType=536870913)*'
|
|
- '*(sAMAccountType=536870912)*'
|
|
- '*(sAMAccountType=268435457)*'
|
|
- '*(sAMAccountType=268435456)*'
|
|
- '*(objectCategory=groupPolicyContainer)*'
|
|
- '*(objectCategory=organizationalUnit)*'
|
|
- '*(objectCategory=Computer)*'
|
|
- '*(objectCategory=nTDSDSA)*'
|
|
- '*(objectCategory=server)*'
|
|
- '*(objectCategory=domain)*'
|
|
- '*(objectCategory=person)*'
|
|
- '*(objectCategory=group)*'
|
|
- '*(objectCategory=user)*'
|
|
- '*(objectClass=trustedDomain)*'
|
|
- '*(objectClass=computer)*'
|
|
- '*(objectClass=server)*'
|
|
- '*(objectClass=group)*'
|
|
- '*(objectClass=user)*'
|
|
- '*(primaryGroupID=521)*'
|
|
- '*(primaryGroupID=516)*'
|
|
- '*(primaryGroupID=515)*'
|
|
- '*(primaryGroupID=512)*'
|
|
- '*Domain Admins*'
|
|
SELECTION_3:
|
|
EventID: 30
|
|
SELECTION_4:
|
|
SearchFilter:
|
|
- '*(domainSid=*)*'
|
|
- '*(objectSid=*)*'
|
|
SELECTION_5:
|
|
EventID: 30
|
|
SELECTION_6:
|
|
SearchFilter:
|
|
- '*(userAccountControl:1.2.840.113556.1.4.803:=4194304)*'
|
|
- '*(userAccountControl:1.2.840.113556.1.4.803:=2097152)*'
|
|
- '*!(userAccountControl:1.2.840.113556.1.4.803:=1048574)*'
|
|
- '*(userAccountControl:1.2.840.113556.1.4.803:=524288)*'
|
|
- '*(userAccountControl:1.2.840.113556.1.4.803:=65536)*'
|
|
- '*(userAccountControl:1.2.840.113556.1.4.803:=8192)*'
|
|
- '*(userAccountControl:1.2.840.113556.1.4.803:=544)*'
|
|
- '*!(UserAccountControl:1.2.840.113556.1.4.803:=2)*'
|
|
- '*msDS-AllowedToActOnBehalfOfOtherIdentity*'
|
|
- '*msDS-AllowedToDelegateTo*'
|
|
- '*(accountExpires=9223372036854775807)*'
|
|
- '*(accountExpires=0)*'
|
|
- '*(adminCount=1)*'
|
|
- '*ms-MCS-AdmPwd*'
|
|
condition: (((SELECTION_1 and SELECTION_2) and not (SELECTION_3 and SELECTION_4))
|
|
or (SELECTION_5 and SELECTION_6))
|
|
id: 31d68132-4038-47c7-8f8e-635a39a7c174
|
|
level: medium
|
|
logsource:
|
|
definition: Requires Microsoft-Windows-LDAP-Client/Debug ETW logging
|
|
product: windows
|
|
service: ldap_debug
|
|
references:
|
|
- https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/hunting-for-reconnaissance-activities-using-ldap-search-filters/ba-p/824726
|
|
- https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1
|
|
- https://github.com/BloodHoundAD/SharpHound3/blob/master/SharpHound3/LdapBuilder.cs
|
|
status: experimental
|
|
tags:
|
|
- attack.discovery
|
|
- attack.t1069.002
|
|
- attack.t1087.002
|
|
- attack.t1482
|
|
ruletype: SIGMA
|