Try in Splunk Security Cloud

Description

This analytic detects an increase in modifications to AD groups or objects. Frequent changes to AD groups or objects can indicate potential security risks, such as unauthorized access attempts, impairing defences or establishing persistence. By monitoring AD logs for unusual modification patterns, this detection helps identify suspicious behavior that could compromise the integrity and security of the AD environment.

  • Type: TTP

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud

  • Last Updated: 2023-10-13
  • Author: Dean Luxton
  • ID: 4f9564dd-a204-4f22-b375-4dfca3a68731

Annotations

ATT&CK

ATT&CK

ID Technique Tactic
T1098 Account Manipulation Persistence, Privilege Escalation
T1562 Impair Defenses Defense Evasion
Kill Chain Phase
  • Installation
  • Exploitation
NIST
  • DE.CM
CIS20
  • CIS 10
CVE 


1
2
3
4
5
6
7
8



`wineventlog_security` EventCode IN (4670,4727,4731,4734,4735,4764) 
| bucket span=5m _time  
| stats values(object) as object, dc(object) as objectCount, values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category) as dest_category by _time, src_user, signature, status 
| eventstats avg(objectCount) as comp_avg, stdev(objectCount) as comp_std by src_user, signature 
| eval upperBound=(comp_avg+comp_std) 
| eval isOutlier=if(objectCount > 10 and (objectCount >= upperBound), 1, 0) 
| search isOutlier=1  
| `windows_increase_in_group_or_object_modification_activity_filter`

Macros

The SPL above uses the following Macros:

:information_source: windows_increase_in_group_or_object_modification_activity_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

  • EventCode
  • src_user
  • signature

How To Implement

Run this detection looking over a 7 day timeframe for best results.

Known False Positives

Unknown

Associated Analytic Story

RBA

Risk Score Impact Confidence Message
8.0 20 40 Spike in Group or Object Modifications performed by $src_user$

:information_source: The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1