Windows active directory user backdoors

This rule is part of a beta feature. To learn more, contact Support.
windows

Classification:

attack

Tactic:

TA0003-persistence

Technique:

T1098-account-manipulation

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Goal

Detects Active Directory user account backdoor configurations through delegation settings and LDAP attribute modifications.

Strategy

This rule monitors Active Directory user account modifications related to delegation permissions and service principal names. The detection tracks user account modifications through event ID 4738 when delegation permissions are modified, and event ID 5136 for LDAP attribute changes including msDS-AllowedToDelegateTo, msDS-AllowedToActOnBehalfOfOtherIdentity, and servicePrincipalName attributes. These modifications can enable unauthorized access and impersonation capabilities within the Active Directory environment.

Triage & Response

  • Examine the modified user account properties and determine if the delegation permissions were authorized by reviewing the {{@usr.id}} making the changes.
  • Validate if the service principal name changes on the affected user accounts align with legitimate business requirements.
  • Review the delegation targets specified in AllowedToDelegateTo attributes to ensure they are authorized services.
  • Analyze authentication patterns for the modified accounts to identify any suspicious delegation or impersonation activity.
  • Restrict delegation permissions to only necessary service accounts.