User Added to the Admin Group

  1[metadata]
  2creation_date = "2024/09/12"
  3integration = ["jamf_protect"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6[transform]
  7[[transform.investigate]]
  8label = "Show events having the same responsible process"
  9providers = [
 10  [
 11    { excluded = false, field = "host.hostname", queryType = "phrase", value = "{{host.hostname}}", valueType = "string" },
 12    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.group_leader.entity_id}}", valueType = "string" }
 13  ]
 14]
 15
 16[[transform.investigate]]
 17label = "Show events having the same parent process"
 18providers = [
 19  [
 20    { excluded = false, field = "host.hostname", queryType = "phrase", value = "{{host.hostname}}", valueType = "string" },
 21    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.parent.entity_id}}", valueType = "string" }
 22  ]
 23]
 24
 25
 26[rule]
 27author = ["Thijs Xhaflaire"]
 28description = "Identifies users being added to the admin group. This could be an indication of privilege\nescalation activity.\n"
 29from = "now-9m"
 30index = ["logs-jamf_protect*"]
 31language = "eql"
 32license = "Elastic License v2"
 33name = "User Added to the Admin Group"
 34note = """## Triage and analysis
 35
 36To thoroughly investigate the actions that occurred **after a user was elevated to administrator**, it's essential to conduct a search on the Timeline. This allows you to review and understand the sequence of events that followed the elevation, helping to identify any potentially malicious or unauthorized activities that might have taken place. **Analyzing these actions is crucial for maintaining security and ensuring that the elevation was not exploited for harmful purposes.**
 37
 38**Consider reviewing these actions:**
 39
 40- Have persistency items been added?
 41- Is any software installed after elevation?
 42- Were any additional users created after elevation?
 43
 44$investigate_0
 45$investigate_1
 46"""
 47references = [
 48    "https://www.loobins.io/binaries/dscl/",
 49    "https://managingosx.wordpress.com/2010/01/14/add-a-user-to-the-admin-group-via-command-line-3-0/",
 50]
 51risk_score = 21
 52rule_id = "04e65517-16e9-4fc4-b7f1-94dc21ecea0d"
 53setup = """## Setup
 54
 55This rule requires data coming in from Jamf Protect.
 56
 57### Jamf Protect Integration Setup
 58Jamf Protect is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events incoming events and send data to the Elastic.
 59
 60#### Prerequisite Requirements:
 61- Fleet is required for Jamf Protect.
 62- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
 63
 64#### The following steps should be executed in order to add the Jamf Protect integration:
 65- Go to the Kibana home page and click "Add integrations".
 66- In the query bar, search for "Jamf Protect" and select the integration to see more details about it.
 67- Click "Add Jamf Protect".
 68- Configure the integration name.
 69- Click "Save and Continue".
 70"""
 71severity = "low"
 72tags = [
 73    "Domain: Endpoint",
 74    "OS: macOS",
 75    "Use Case: Threat Detection",
 76    "Tactic: Privilege Escalation",
 77    "Data Source: Jamf Protect",
 78    "Resources: Investigation Guide",
 79    "Noise: Low",
 80    "Performance: Fast",
 81    "Rule Type: Event Correlation (EQL)",
 82    "Platform: macOS",
 83    "Data Source: Jamf Protect Event Logs",
 84]
 85timestamp_override = "event.ingested"
 86type = "eql"
 87
 88query = '''
 89configuration where host.os.type == "macos" and event.type == "change" and
 90  event.action == "od_group_add" and group.name:"admin"
 91'''
 92
 93
 94[[rule.threat]]
 95framework = "MITRE ATT&CK"
 96
 97[[rule.threat.technique]]
 98id = "T1078"
 99name = "Valid Accounts"
100reference = "https://attack.mitre.org/techniques/T1078/"
101
102[[rule.threat.technique.subtechnique]]
103id = "T1078.003"
104name = "Local Accounts"
105reference = "https://attack.mitre.org/techniques/T1078/003/"
106
107[[rule.threat.technique]]
108id = "T1098"
109name = "Account Manipulation"
110reference = "https://attack.mitre.org/techniques/T1098/"
111
112[[rule.threat.technique.subtechnique]]
113id = "T1098.007"
114name = "Additional Local or Domain Groups"
115reference = "https://attack.mitre.org/techniques/T1098/007/"
116
117[rule.threat.tactic]
118id = "TA0004"
119name = "Privilege Escalation"
120reference = "https://attack.mitre.org/tactics/TA0004/"