Creation of a DNS-Named Record

 1[metadata]
 2creation_date = "2024/03/26"
 3integration = ["system", "windows"]
 4maturity = "production"
 5updated_date = "2024/10/15"
 6min_stack_version = "8.14.0"
 7min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Active Directory Integrated DNS (ADIDNS) is one of the core components of AD DS, leveraging AD's access control and
13replication to maintain domain consistency. It stores DNS zones as AD objects, a feature that, while robust, introduces
14some security issues because of the default permission (Any authenticated users) to create DNS-named records. Attackers
15can perform Dynamic Spoofing attacks, where they monitor LLMNR/NBT-NS requests and create DNS-named records to target
16systems that are requested from multiple systems. They can also create specific records to target specific services,
17such as wpad, for spoofing attacks.
18"""
19from = "now-9m"
20index = ["winlogbeat-*", "logs-system.*", "logs-windows.*"]
21language = "eql"
22license = "Elastic License v2"
23name = "Creation of a DNS-Named Record"
24references = [
25    "https://www.netspi.com/blog/technical/network-penetration-testing/adidns-revisited/",
26    "https://www.thehacker.recipes/a-d/movement/mitm-and-coerced-authentications/wpad-spoofing",
27]
28risk_score = 21
29rule_id = "1e1b2e7e-b8f5-45e5-addc-66cc1224ffbc"
30setup = """## Setup
31
32The 'Audit Directory Service Changes' logging policy must be configured for (Success, Failure).
33Steps to implement the logging policy with Advanced Audit Configuration:

1
2The above policy does not cover the target object by default (we still need it to be configured to generate events), so we need to set up an AuditRule using https://github.com/OTRF/Set-AuditRule.

 1"""
 2severity = "low"
 3tags = [
 4    "Domain: Endpoint",
 5    "OS: Windows",
 6    "Use Case: Threat Detection",
 7    "Tactic: Credential Access",
 8    "Data Source: Active Directory",
 9    "Use Case: Active Directory Monitoring",
10    "Data Source: System",
11]
12timestamp_override = "event.ingested"
13type = "eql"
14
15query = '''
16any where host.os.type == "windows" and event.action in ("Directory Service Changes", "directory-service-object-modified") and
17    event.code == "5137" and winlog.event_data.ObjectClass == "dnsNode" and
18    not winlog.event_data.SubjectUserName : "*$"
19'''
20
21
22[[rule.threat]]
23framework = "MITRE ATT&CK"
24[[rule.threat.technique]]
25id = "T1557"
26name = "Adversary-in-the-Middle"
27reference = "https://attack.mitre.org/techniques/T1557/"
28
29
30[rule.threat.tactic]
31id = "TA0006"
32name = "Credential Access"
33reference = "https://attack.mitre.org/tactics/TA0006/"