ID | Technique | Tactic |
---|---|---|
T1484 | Domain or Tenant Policy Modification | Defense Evasion |
T1484.001 | Group Policy Modification | Privilege Escalation |
T1222 | File and Directory Permissions Modification | Defense Evasion |
T1222.001 | Windows File and Directory Permissions Modification | Privilege Escalation |
Detection: Windows AD GPO New CSE Addition
Description
This detection identifies when a a new client side extension is added to an Active Directory Group Policy using the Group Policy Management Console.
Search
1`wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=gPCMachineExtensionNames
2| stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId
3| rex field=old_value max_match=10000 "(?P<old_values>\{.*?\})"
4| rex field=new_value max_match=10000 "(?P<new_values>\{.*?\})"
5| rex field=ObjectDN max_match=10000 "CN=(?P<policy_guid>\{.*?\})"
6| mvexpand new_values
7| where NOT new_values IN (old_values,"{00000000-0000-0000-0000-000000000000}",policy_guid) AND match(new_values, "^\{[A-Z
8|\d]+\-[A-Z
9|\d]+\-[A-Z
10|\d]+\-[A-Z
11|\d]+\-[A-Z
12|\d]+\}")
13| lookup msad_guid_lookup guid as new_values OUTPUTNEW displayName as policyType
14| eval newPolicy=if(policyType like "%",policyType,new_values)
15| join ObjectDN [
16| search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update
17| stats latest(displayName) as displayName by distinguishedName
18| eval ObjectDN=upper(distinguishedName)]
19| stats values(OpCorrelationID) as OpCorrelationID values(src_user) as src_user values(SubjectLogonId) as SubjectLogonId values(newPolicy) as newPolicy values(displayName) as policyName by ObjectDN
20| `windows_ad_gpo_new_cse_addition_filter`
Data Source
Name | Platform | Sourcetype | Source | Supported App |
---|---|---|---|---|
N/A | N/A | N/A | N/A | N/A |
Macros Used
Name | Value |
---|---|
admon | source=ActiveDirectory |
windows_ad_gpo_new_cse_addition_filter | search * |
windows_ad_gpo_new_cse_addition_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Notable | Yes |
Rule Title | %name% |
Rule Description | %description% |
Notable Event Fields | user, dest |
Creates Risk Event | True |
Implementation
Ensure you are ingesting Active Directory audit logs - specifically event 5136, admon data is also used to display the display name of the GPO. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security and admon macros are configured with the correct indexes.
Known False Positives
General usage of group policy will trigger this detection, also please not GPOs modified using tools such as SharpGPOAbuse will not generate the AD audit events which enable this detection.
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
$src_user$ has added new GPO Client Side Extensions $newPolicy$ to the policy $policyName$ | 100 | 100 | 100 |
References
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | XmlWinEventLog:Security |
xmlwineventlog |
Integration | ✅ Passing | Dataset | XmlWinEventLog:Security |
xmlwineventlog |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 1