Query: detection rule: Detects when multi-factor authentication (MFA) is disabled.
Matching passage: Sigma rule: Detects when multi-factor authentication (MFA) is disabled.. Logsource: gcp / google_workspace.admin. Rule: title: Google Workspace MFA Disabled id: 780601d1-6376-4f2a-884e-b8d45599f78c status: test description: Detects when multi-factor authentication (MFA) is disabled. references: - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3 - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings#ENFORCE_STRONG_AUTHENTICATION - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings?hl=en#ALLOW_STRONG_AUTHENTICATION author: Austin Songer date: 2021-08-26 modified: 2023-10-11 tags: - attack.impact logsource: product: gcp service: google_workspace.admin detection: selection_base: eventService: admin.googleapis.com eventName: - ENFORCE_STRONG_AUTHENTICATION - ALLOW_STRONG_AUTHENTICATION selection_eventValue: new_value: 'false' condition: all of selection* falsepositives: - MFA may be disabled and performed by a system administrator. level: medium
Near-miss passage: Sigma rule: Backdooring domain object to grant the rights associated with DCSync to a regular user or machine account using Powervie. Logsource: windows / security. Rule: title: Powerview Add-DomainObjectAcl DCSync AD Extend Right id: 2c99737c-585d-4431-b61a-c911d86ff32f status: test description: Backdooring domain object to grant the rights associated with DCSync to a regular user or machine account using Powerview\Add-DomainObjectAcl DCSync Extended Right cmdlet, will allow to re-obtain the pwd hashes of any user/computer references: - https://twitter.com/menasec1/status/1111556090137903104 - https://www.specterops.io/assets/resources/an_ace_up_the_sleeve.pdf author: Samir Bousseaden, Roberto Rodriguez @Cyb3rWard0g, oscd.community, Tim Shelton, Maxence Fossat date: 2019-04-03 modified: 2022-08-16 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: windows service: security definition: 'Requirements: The "Audit Directory Service Changes" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule)' detection: selection: EventID: 5136 AttributeLDAPDisplayName: ntSecurityDescriptor AttributeValue|contains: - 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 - 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 - 89e95b76-444d-4c62-991a-0facbeda640c filter_main_dns_object_class: ObjectClass: - dnsNode - dnsZoneScope - dnsZone condition: selection and not 1 of filter_main_* falsepositives: - New Domain Controller computer account, check user SIDs within the value attribute of event 5136 and verify if it's a regular user or DC computer account. level: high