ID | Technique | Tactic |
---|---|---|
T1098 | Account Manipulation | Persistence |
T1562 | Impair Defenses | Privilege Escalation |
Detection: Windows Increase in User Modification Activity
Description
This analytic detects an increase in modifications to AD user objects. A large volume of changes to user objects can indicate potential security risks, such as unauthorized access attempts, impairing defences or establishing persistence. By monitoring AD logs for unusual modification patterns, this detection helps identify suspicious behavior that could compromise the integrity and security of the AD environment.
Search
1`wineventlog_security` EventCode IN (4720,4722,4723,4724,4725,4726,4728,4732,4733,4738,4743,4780)
2| bucket span=5m _time
3| stats values(TargetDomainName) as TargetDomainName, values(user) as user, dc(user) as userCount, values(user_category) as user_category, values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category) as dest_category by _time, src_user, signature, status
4| eventstats avg(userCount) as comp_avg , stdev(userCount) as comp_std by src_user, signature
5| eval upperBound=(comp_avg+comp_std*3)
6| eval isOutlier=if(userCount > 10 and userCount >= upperBound, 1, 0)
7| search isOutlier=1
8| stats values(TargetDomainName) as TargetDomainName, values(user) as user, dc(user) as userCount, values(user_category) as user_category, values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category) as dest_category values(signature) as signature by _time, src_user, status
9| `windows_increase_in_user_modification_activity_filter`
Data Source
Name | Platform | Sourcetype | Source |
---|---|---|---|
Windows Event Log Security 4720 | Windows | 'xmlwineventlog' |
'XmlWinEventLog:Security' |
Macros Used
Name | Value |
---|---|
wineventlog_security | eventtype=wineventlog_security OR Channel=security OR source=XmlWinEventLog:Security |
windows_increase_in_user_modification_activity_filter | search * |
windows_increase_in_user_modification_activity_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Notable | Yes |
Rule Title | %name% |
Rule Description | %description% |
Notable Event Fields | user, dest |
Creates Risk Event | True |
Implementation
Run this detection looking over a 7 day timeframe for best results.
Known False Positives
Genuine activity
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
Spike in User Modification actions performed by $src_user$ | 8 | 20 | 40 |
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | XmlWinEventLog:Security |
XmlWinEventLog |
Integration | ✅ Passing | Dataset | XmlWinEventLog:Security |
XmlWinEventLog |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 2