Detectionhightest

Active Directory User Backdoors

Detects scenarios where one can control another users or computers account without having to use their credentials.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
@neu5ronCreated Thu Apr 13Updated Mon Feb 26300bac00-e041-4ee2-9c36-e262656a6eccwindows
Log Source
Windowssecurity
ProductWindows← raw: windows
Servicesecurity← raw: security

Definition

Requirements: Audit Policy : Account Management > Audit User Account Management, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit User Account Management, DS Access > Audit Directory Service Changes, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\DS Access\Audit Directory Service Changes

Detection Logic
Detection Logic6 selectors
detection:
    selection1:
        EventID: 4738
    filter_empty:
        AllowedToDelegateTo:
            - ''
            - '-'
    filter_null:
        AllowedToDelegateTo: null
    selection_5136_1:
        EventID: 5136
        AttributeLDAPDisplayName: 'msDS-AllowedToDelegateTo'
    selection_5136_2:
        EventID: 5136
        ObjectClass: 'user'
        AttributeLDAPDisplayName: 'servicePrincipalName'
    selection_5136_3:
        EventID: 5136
        AttributeLDAPDisplayName: 'msDS-AllowedToActOnBehalfOfOtherIdentity'
    condition: (selection1 and not 1 of filter_*) or 1 of selection_5136_*
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

Rule Metadata
Rule ID
300bac00-e041-4ee2-9c36-e262656a6ecc
Status
test
Level
high
Type
Detection
Created
Thu Apr 13
Modified
Mon Feb 26
Author
Path
rules/windows/builtin/security/win_security_alert_ad_user_backdoors.yml
Raw Tags
attack.privilege-escalationattack.t1098attack.persistence
View on GitHub