Potential ADIDNS Poisoning via Wildcard Record Creation

calendar Oct 15, 2024 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Data Source: Active Directory Use Case: Active Directory Monitoring Data Source: System  ·
Share on: linkedin copy

Active Directory Integrated DNS (ADIDNS) is one of the core components of AD DS, leveraging AD's access control and replication to maintain domain consistency. It stores DNS zones as AD objects, a feature that, while robust, introduces some security issues, such as wildcard records, mainly because of the default permission (Any authenticated users) to create DNS-named records. Attackers can create wildcard records to redirect traffic that doesn't explicitly match records contained in the zone, becoming the Man-in-the-Middle and being able to abuse DNS similarly to LLMNR/NBNS spoofing.

Elastic rule (View on GitHub)

 1[metadata]
 2creation_date = "2024/03/26"
 3integration = ["system", "windows"]
 4maturity = "production"
 5updated_date = "2024/10/15"
 6min_stack_version = "8.14.0"
 7min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Active Directory Integrated DNS (ADIDNS) is one of the core components of AD DS, leveraging AD's access control and
13replication to maintain domain consistency. It stores DNS zones as AD objects, a feature that, while robust, introduces
14some security issues, such as wildcard records, mainly because of the default permission (Any authenticated users) to
15create DNS-named records. Attackers can create wildcard records to redirect traffic that doesn't explicitly match
16records contained in the zone, becoming the Man-in-the-Middle and being able to abuse DNS similarly to LLMNR/NBNS
17spoofing.
18"""
19from = "now-9m"
20index = ["winlogbeat-*", "logs-system.*", "logs-windows.*"]
21language = "eql"
22license = "Elastic License v2"
23name = "Potential ADIDNS Poisoning via Wildcard Record Creation"
24references = [
25    "https://www.netspi.com/blog/technical/network-penetration-testing/exploiting-adidns/",
26    "https://www.thehacker.recipes/a-d/movement/mitm-and-coerced-authentications/adidns-spoofing",
27]
28risk_score = 73
29rule_id = "8f242ffb-b191-4803-90ec-0f19942e17fd"
30setup = """## Setup
31
32The 'Audit Directory Service Changes' logging policy must be configured for (Success, Failure).
33Steps to implement the logging policy with Advanced Audit Configuration:

Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policies Configuration > Audit Policies > DS Access > Audit Directory Service Changes (Success,Failure)

1
2The above policy does not cover the target object by default (we still need it to be configured to generate events), so we need to set up an AuditRule using https://github.com/OTRF/Set-AuditRule.

Set-AuditRule -AdObjectPath 'AD:\CN=MicrosoftDNS,DC=DomainDNSZones,DC=Domain,DC=com' -WellKnownSidType WorldSid -Rights CreateChild -InheritanceFlags Descendents -AttributeGUID e0fa1e8c-9b45-11d0-afdd-00c04fd930c9 -AuditFlags Success

 1"""
 2severity = "high"
 3tags = [
 4    "Domain: Endpoint",
 5    "OS: Windows",
 6    "Use Case: Threat Detection",
 7    "Tactic: Credential Access",
 8    "Data Source: Active Directory",
 9    "Use Case: Active Directory Monitoring",
10    "Data Source: System",
11]
12timestamp_override = "event.ingested"
13type = "eql"
14
15query = '''
16any where host.os.type == "windows" and event.action in ("Directory Service Changes", "directory-service-object-modified") and
17    event.code == "5137" and startsWith(winlog.event_data.ObjectDN, "DC=*,")
18'''
19
20
21[[rule.threat]]
22framework = "MITRE ATT&CK"
23[[rule.threat.technique]]
24id = "T1557"
25name = "Adversary-in-the-Middle"
26reference = "https://attack.mitre.org/techniques/T1557/"
27
28
29[rule.threat.tactic]
30id = "TA0006"
31name = "Credential Access"
32reference = "https://attack.mitre.org/tactics/TA0006/"

References

Related rules

to-top