Try in Splunk Security Cloud

Description

This analytic detects an increase in modifications to AD user objects. A large volume of changes to user objects can indicate potential security risks, such as unauthorized access attempts, impairing defences or establishing persistence. By monitoring AD logs for unusual modification patterns, this detection helps identify suspicious behavior that could compromise the integrity and security of the AD environment.

  • Type: TTP

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud

  • Last Updated: 2023-10-13
  • Author: Dean Luxton
  • ID: 0995fca1-f346-432f-b0bf-a66d14e6b428

Annotations

ATT&CK

ATT&CK

ID Technique Tactic
T1098 Account Manipulation Persistence, Privilege Escalation
T1562 Impair Defenses Defense Evasion
Kill Chain Phase
  • Installation
  • Exploitation
NIST
  • DE.CM
CIS20
  • CIS 10
CVE 


1
2
3
4
5
6
7
8
9



`wineventlog_security` EventCode IN (4720,4722,4723,4724,4725,4726,4728,4732,4733,4738,4743,4780) 
| bucket span=5m _time  
| stats values(TargetDomainName) as TargetDomainName, values(user) as user, dc(user) as userCount, values(user_category) as user_category, values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category) as dest_category by _time, src_user, signature, status 
| eventstats avg(userCount) as comp_avg , stdev(userCount) as comp_std by src_user, signature 
| eval upperBound=(comp_avg+comp_std*3) 
| eval isOutlier=if(userCount > 10 and userCount >= upperBound, 1, 0)  
| search isOutlier=1 
| stats values(TargetDomainName) as TargetDomainName, values(user) as user, dc(user) as userCount, values(user_category) as user_category, values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category) as dest_category values(signature) as signature  by _time, src_user, status 
| `windows_increase_in_user_modification_activity_filter`

Macros

The SPL above uses the following Macros:

:information_source: windows_increase_in_user_modification_activity_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

  • EventCode
  • src_user
  • signature

How To Implement

Run this detection looking over a 7 day timeframe for best results.

Known False Positives

Genuine activity

Associated Analytic Story

RBA

Risk Score Impact Confidence Message
8.0 20 40 Spike in User Modification actions performed by $src_user$

:information_source: The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1