Query: Sigma rule for Backdooring domain object to grant the rights associated with DCSync to a regular user or machine account using Powervie
Matching passage: Sigma rule: Backdooring domain object to grant the rights associated with DCSync to a regular user or machine account using Powervie. Logsource: windows / security. Rule: title: Powerview Add-DomainObjectAcl DCSync AD Extend Right id: 2c99737c-585d-4431-b61a-c911d86ff32f status: test description: Backdooring domain object to grant the rights associated with DCSync to a regular user or machine account using Powerview\Add-DomainObjectAcl DCSync Extended Right cmdlet, will allow to re-obtain the pwd hashes of any user/computer references: - https://twitter.com/menasec1/status/1111556090137903104 - https://www.specterops.io/assets/resources/an_ace_up_the_sleeve.pdf author: Samir Bousseaden, Roberto Rodriguez @Cyb3rWard0g, oscd.community, Tim Shelton, Maxence Fossat date: 2019-04-03 modified: 2022-08-16 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: windows service: security definition: 'Requirements: The "Audit Directory Service Changes" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule)' detection: selection: EventID: 5136 AttributeLDAPDisplayName: ntSecurityDescriptor AttributeValue|contains: - 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 - 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 - 89e95b76-444d-4c62-991a-0facbeda640c filter_main_dns_object_class: ObjectClass: - dnsNode - dnsZoneScope - dnsZone condition: selection and not 1 of filter_main_* falsepositives: - New Domain Controller computer account, check user SIDs within the value attribute of event 5136 and verify if it's a regular user or DC computer account. level: high
Near-miss passage: Sigma rule: Detects Processes accessing the camera and microphone from suspicious folder. Logsource: windows / registry_event. Rule: title: Suspicious Camera and Microphone Access id: 62120148-6b7a-42be-8b91-271c04e281a3 status: test description: Detects Processes accessing the camera and microphone from suspicious folder references: - https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072 author: Den Iuzvyk date: 2020-06-07 modified: 2022-10-09 tags: - attack.collection - attack.t1125 - attack.t1123 logsource: category: registry_event product: windows detection: selection_1: TargetObject|contains|all: - \Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\ - \NonPackaged selection_2: TargetObject|contains: - microphone - webcam selection_3: TargetObject|contains: - :#Windows#Temp# - :#$Recycle.bin# - :#Temp# - :#Users#Public# - :#Users#Default# - :#Users#Desktop# condition: all of selection_* falsepositives: - Unlikely, there could be conferencing software running from a Temp folder accessing the devices level: high