Creation of a DNS-Named Record

calendar Jul 10, 2024 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Data Source: Active Directory Use Case: Active Directory Monitoring  ·
Share on: linkedin copy

Active Directory Integrated DNS (ADIDNS) is one of the core components of AD DS, leveraging AD's access control and replication to maintain domain consistency. It stores DNS zones as AD objects, a feature that, while robust, introduces some security issues because of the default permission (Any authenticated users) to create DNS-named records. Attackers can perform Dynamic Spoofing attacks, where they monitor LLMNR/NBT-NS requests and create DNS-named records to target systems that are requested from multiple systems. They can also create specific records to target specific services, such as wpad, for spoofing attacks.

Elastic rule (View on GitHub)

 1[metadata]
 2creation_date = "2024/03/26"
 3integration = ["system", "windows"]
 4maturity = "production"
 5updated_date = "2024/07/08"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Active Directory Integrated DNS (ADIDNS) is one of the core components of AD DS, leveraging AD's access control and
11replication to maintain domain consistency. It stores DNS zones as AD objects, a feature that, while robust, introduces
12some security issues because of the default permission (Any authenticated users) to create DNS-named records. Attackers
13can perform Dynamic Spoofing attacks, where they monitor LLMNR/NBT-NS requests and create DNS-named records to target
14systems that are requested from multiple systems. They can also create specific records to target specific services,
15such as wpad, for spoofing attacks.
16"""
17from = "now-9m"
18index = ["winlogbeat-*", "logs-system.*", "logs-windows.*"]
19language = "eql"
20license = "Elastic License v2"
21name = "Creation of a DNS-Named Record"
22references = [
23    "https://www.netspi.com/blog/technical/network-penetration-testing/adidns-revisited/",
24    "https://www.thehacker.recipes/a-d/movement/mitm-and-coerced-authentications/wpad-spoofing",
25]
26risk_score = 21
27rule_id = "1e1b2e7e-b8f5-45e5-addc-66cc1224ffbc"
28setup = """## Setup
29
30The 'Audit Directory Service Changes' logging policy must be configured for (Success, Failure).
31Steps to implement the logging policy with Advanced Audit Configuration:

Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policies Configuration > Audit Policies > DS Access > Audit Directory Service Changes (Success,Failure)

1
2The above policy does not cover the target object by default (we still need it to be configured to generate events), so we need to set up an AuditRule using https://github.com/OTRF/Set-AuditRule.

Set-AuditRule -AdObjectPath 'AD:\CN=MicrosoftDNS,DC=DomainDNSZones,DC=Domain,DC=com' -WellKnownSidType WorldSid -Rights CreateChild -InheritanceFlags Descendents -AttributeGUID e0fa1e8c-9b45-11d0-afdd-00c04fd930c9 -AuditFlags Success

 1"""
 2severity = "low"
 3tags = [
 4    "Domain: Endpoint",
 5    "OS: Windows",
 6    "Use Case: Threat Detection",
 7    "Tactic: Credential Access",
 8    "Data Source: Active Directory",
 9    "Use Case: Active Directory Monitoring",
10]
11timestamp_override = "event.ingested"
12type = "eql"
13
14query = '''
15any where host.os.type == "windows" and event.action in ("Directory Service Changes", "directory-service-object-modified") and
16    event.code == "5137" and winlog.event_data.ObjectClass == "dnsNode" and
17    not winlog.event_data.SubjectUserName : "*$"
18'''
19
20
21[[rule.threat]]
22framework = "MITRE ATT&CK"
23[[rule.threat.technique]]
24id = "T1557"
25name = "Adversary-in-the-Middle"
26reference = "https://attack.mitre.org/techniques/T1557/"
27
28
29[rule.threat.tactic]
30id = "TA0006"
31name = "Credential Access"
32reference = "https://attack.mitre.org/tactics/TA0006/"

References

Related rules

to-top