Query: rule covering Detects possible addition of shadow credentials to an active directory object.
Matching passage: Sigma rule: Detects possible addition of shadow credentials to an active directory object.. Logsource: windows / security. Rule: title: Possible Shadow Credentials Added id: f598ea0c-c25a-4f72-a219-50c44411c791 status: test description: Detects possible addition of shadow credentials to an active directory object. references: - https://www.elastic.co/guide/en/security/8.4/potential-shadow-credentials-added-to-ad-object.html - https://cyberstoph.org/posts/2022/03/detecting-shadow-credentials/ - https://twitter.com/SBousseaden/status/1581300963650187264? author: Nasreddine Bencherchali (Nextron Systems), Elastic (idea) date: 2022-10-17 tags: - attack.persistence - attack.credential-access - attack.defense-impairment - attack.t1556 logsource: product: windows service: security definition: The "Audit Directory Service Changes" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule) detection: selection: EventID: 5136 AttributeLDAPDisplayName: msDS-KeyCredentialLink condition: selection falsepositives: - Modifications in the msDS-KeyCredentialLink attribute can be done legitimately by the Azure AD Connect synchronization account or the ADFS service account. These accounts can be added as Exceptions. (From elastic FP section) level: high
Near-miss passage: Sigma rule: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.. Logsource: windows / process_creation. Rule: title: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2 id: c98f2a0d-e1b8-4f76-90d3-359caf88d6b9 status: test description: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity. author: '@Kostastsale, TheDFIRReport' references: - Internal Research tags: - attack.stealth date: 2022-12-05 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - 🤷🏼 - 🤷🏼‍♂️ - 🙎🏼‍♀️ - 🙎🏼 - 🙎🏼‍♂️ - 🙍🏼‍♀️ - 🙍🏼 - 🙍🏼‍♂️ - 💇🏼‍♀️ - 💇🏼 - 💇🏼‍♂️ - 💆🏼‍♀️ - 💆🏼 - 💆🏼‍♂️ - 🧖🏼‍♀️ - 🧖🏼 - 🧖🏼‍♂️ - 💃🏼 - 🕺🏼 - 🕴🏼 - 👩🏼‍🦽 - 🧑🏼‍🦽 - 👨🏼‍🦽 - 👩🏼‍🦼 - 🧑🏼‍🦼 - 👨🏼‍🦼 - 🚶🏼‍♀️ - 🚶🏼 - 🚶🏼‍♂️ - 👩🏼‍🦯 - 🧑🏼‍🦯 - 👨🏼‍🦯 - 🧎🏼‍♀️ - 🧎🏼 - 🧎🏼‍♂️ - 🏃🏼‍♀️ - 🏃🏼 - 🏃🏼‍♂️ - 🧍🏼‍♀️ - 🧍🏼 - 🧍🏼‍♂️ - 👭🏼 - 🧑🏼‍🤝‍🧑🏼 - 👬🏼 - 👫🏼 - 🧗🏼‍♀️ - 🧗🏼 - 🧗🏼‍♂️ - 🏇🏼 - 🏂🏼 - 🏌🏼‍♀️ - 🏌🏼 - 🏌🏼‍♂️ - 🏄🏼‍♀️ - 🏄🏼 - 🏄🏼‍♂️ - 🚣🏼‍♀️ - 🚣🏼 - 🚣🏼‍♂️ - 🏊🏼‍♀️ - 🏊🏼 - 🏊🏼‍♂️ - ⛹🏼‍♀️ - ⛹🏼 - ⛹🏼‍♂️ - 🏋🏼‍♀️ - 🏋🏼 - 🏋🏼‍♂️ - 🚴🏼‍♀️ - 🚴🏼 - 🚴🏼‍♂️ - 🚵🏼‍♀️ - 🚵🏼 - 🚵🏼‍♂️ - 🤸🏼‍♀️ - 🤸🏼 - 🤸🏼‍♂️ - 🤽🏼‍♀️ - 🤽🏼 - 🤽🏼‍♂️ - 🤾🏼‍♀️ - 🤾🏼 - 🤾🏼‍♂️ - 🤹🏼‍♀️ - 🤹🏼 - 🤹🏼‍♂️ - 🧘🏼‍♀️ - 🧘🏼 - 🧘🏼‍♂️ - 🛀🏼 - 🛌🏼 - 👋🏽 - 🤚🏽 - 🖐🏽 - ✋🏽 - 🖖🏽 - 👌🏽 - 🤌🏽 - 🤏🏽 - ✌🏽 - 🤞🏽 - 🫰🏽 - 🤟🏽 - 🤘🏽 - 🤙🏽 - 🫵🏽 - 🫱🏽 - 🫲🏽 - 🫳🏽 - 🫴🏽 - 👈🏽 - 👉🏽 - 👆🏽 - 🖕🏽 - 👇🏽 - ☝🏽 - 👍🏽 - 👎🏽 - ✊🏽 - 👊🏽 - 🤛🏽 - 🤜🏽 - 👏🏽 - 🫶🏽 - 🙌🏽 - 👐🏽 - 🤲🏽 - 🙏🏽 - ✍🏽 - 💪🏽 - 🦵🏽 - 🦶🏽 - 👂🏽 - 🦻🏽 - 👃🏽 - 👶🏽 - 👧🏽 - 🧒🏽 - 👦🏽 - 👩🏽 - 🧑🏽 - 👨🏽 - 👩🏽‍🦱 - 🧑🏽‍🦱 - 👨🏽‍🦱 - 👩🏽‍🦰 - 🧑🏽‍🦰 - 👨🏽‍🦰 - 👱🏽‍♀️ - 👱🏽 - 👱🏽‍♂️ - 👩🏽‍🦳 - 🧑🏽‍🦳 - 👨🏽‍🦳 - 👩🏽‍🦲 - 🧑🏽‍🦲 - 👨🏽‍🦲 - 🧔🏽‍♀️ - 🧔🏽 - 🧔🏽‍♂️ - 👵🏽 - 🧓🏽 - 👴🏽 - 👲🏽 - 👳🏽‍♀️ - 👳🏽 - 👳🏽‍♂️ - 🧕🏽 - 👮🏽‍♀️ - 👮🏽 - 👮🏽‍♂️ - 👷🏽‍♀️ - 👷🏽 - 👷🏽‍♂️ - 💂🏽‍♀️ - 💂🏽 - 💂🏽‍♂️ - 🕵🏽‍♀️ - 🕵🏽 - 🕵🏽‍♂️ - 👩🏽‍⚕️ - 🧑🏽‍⚕️ - 👨🏽‍⚕️ - 👩🏽‍🌾 - 🧑🏽‍🌾 - 👨🏽‍🌾 - 👩🏽‍🍳 - 🧑🏽‍🍳 - 👨🏽‍🍳 - 👩🏽‍🎓 - 🧑🏽‍🎓 - 👨🏽‍🎓 - 👩🏽‍🎤 - 🧑🏽‍🎤 - 👨🏽‍🎤 - 👩🏽‍🏫 - 🧑🏽‍🏫 - 👨🏽‍🏫 - 👩🏽‍🏭 - 🧑🏽‍🏭 - 👨🏽‍🏭 - 👩🏽‍💻 - 🧑🏽‍💻 - 👨🏽‍💻 - 👩🏽‍💼 - 🧑🏽‍💼 - 👨🏽‍💼 - 👩🏽‍🔧 - 🧑🏽‍🔧 - 👨🏽‍🔧 - 👩🏽‍🔬 - 🧑🏽‍🔬 - 👨🏽‍🔬 - 👩🏽‍🎨 - 🧑🏽‍🎨 - 👨🏽‍🎨 - 👩🏽‍🚒 - 🧑🏽‍🚒 - 👨🏽‍🚒 - 👩🏽‍✈️ - 🧑🏽‍✈️ - 👨🏽‍✈️ - 👩🏽‍🚀 - 🧑🏽‍🚀 - 👨🏽‍🚀 - 👩🏽‍⚖️ - 🧑🏽‍⚖️ - 👨🏽‍⚖️ - 👰🏽‍♀️ - 👰🏽 - 👰🏽‍♂️ - 🤵🏽‍♀️ - 🤵🏽 - 🤵🏽‍♂️ - 👸🏽 - 🫅🏽 - 🤴🏽 - 🥷🏽 - 🦸🏽‍♀️ - 🦸🏽 - 🦸🏽‍♂️ - 🦹🏽‍♀️ - 🦹🏽 - 🦹🏽‍♂️ - 🤶🏽 - 🧑🏽‍🎄 - 🎅🏽 - 🧙🏽‍♀️ - 🧙🏽 - 🧙🏽‍♂️ - 🧝🏽‍♀️ - 🧝🏽 - 🧝🏽‍♂️ - 🧛🏽‍♀️ - 🧛🏽 - 🧛🏽‍♂️ - 🧜🏽‍♀️ - 🧜🏽 - 🧜🏽‍♂️ - 🧚🏽‍♀️ - 🧚🏽 - 🧚🏽‍♂️ - 👼🏽 - 🤰🏽 - 🫄🏽 - 🫃🏽 - 🤱🏽 - 👩🏽‍🍼 - 🧑🏽‍🍼 - 👨🏽‍🍼 - 🙇🏽‍♀️ - 🙇🏽 - 🙇🏽‍♂️ - 💁🏽‍♀️ - 💁🏽 - 💁🏽‍♂️ - 🙅🏽‍♀️ - 🙅🏽 - 🙅🏽‍♂️ - 🙆🏽‍♀️ - 🙆🏽 - 🙆🏽‍♂️ - 🙋🏽‍♀️ - 🙋🏽 - 🙋🏽‍♂️ - 🧏🏽‍♀️ - 🧏🏽 - 🧏🏽‍♂️ - 🤦🏽‍♀️ - 🤦🏽 - 🤦🏽‍♂️ - 🤷🏽‍♀️ - 🤷🏽 - 🤷🏽‍♂️ - 🙎🏽‍♀️ - 🙎🏽 - 🙎🏽‍♂️ - 🙍🏽‍♀️ - 🙍🏽 - 🙍🏽‍♂️ - 💇🏽‍♀️ - 💇🏽 - 💇🏽‍♂️ - 💆🏽‍♀️ - 💆🏽 - 💆🏽‍♂️ - 🧖🏽‍♀️ - 🧖🏽 - 🧖🏽‍♂️ - 💃🏽 - 🕺🏽 - 🕴🏽 - 👩