IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Access to a Sensitive LDAP Attribute
editAccess to a Sensitive LDAP Attribute
editIdentify access to sensitive Active Directory object attributes that contains credentials and decryption keys such as unixUserPassword, ms-PKI-AccountCredentials and msPKI-CredentialRoamingTokens.
Rule type: eql
Rule indices:
- winlogbeat-*
- logs-system.*
- logs-windows.*
Severity: medium
Risk score: 47
Runs every: 5m
Searches indices from: now-9m (Date Math format, see also Additional look-back time
)
Maximum alerts per execution: 100
References:
Tags:
- Domain: Endpoint
- OS: Windows
- Use Case: Threat Detection
- Tactic: Credential Access
- Use Case: Active Directory Monitoring
- Data Source: Active Directory
Version: 6
Rule authors:
- Elastic
Rule license: Elastic License v2
Investigation guide
editThe 'Audit Directory Service Changes' logging policy must be configured for (Success, Failure). Steps to implement the logging policy with Advanced Audit Configuration: ``` Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policies Configuration > Audit Policies > DS Access > Audit Directory Service Changes (Success,Failure) ```
Rule query
editany where event.action == "Directory Service Access" and event.code == "4662" and not winlog.event_data.SubjectUserSid : "S-1-5-18" and winlog.event_data.Properties : ( /* unixUserPassword */ "*612cb747-c0e8-4f92-9221-fdd5f15b550d*", /* ms-PKI-AccountCredentials */ "*b8dfa744-31dc-4ef1-ac7c-84baf7ef9da7*", /* ms-PKI-DPAPIMasterKeys */ "*b3f93023-9239-4f7c-b99c-6745d87adbc2*", /* msPKI-CredentialRoamingTokens */ "*b7ff5a38-0818-42b0-8110-d3d154c97f24*" ) and /* Excluding noisy AccessMasks 0x0 undefined and 0x100 Control Access https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662 */ not winlog.event_data.AccessMask in ("0x0", "0x100")
Framework: MITRE ATT&CKTM
-
Tactic:
- Name: Credential Access
- ID: TA0006
- Reference URL: https://attack.mitre.org/tactics/TA0006/
-
Technique:
- Name: OS Credential Dumping
- ID: T1003
- Reference URL: https://attack.mitre.org/techniques/T1003/