Access to a Sensitive LDAP Attribute

  1[metadata]
  2creation_date = "2022/11/09"
  3integration = ["system", "windows"]
  4maturity = "production"
  5updated_date = "2026/10/06"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identify access to sensitive Active Directory object attributes that contains credentials and decryption keys such as
 11ms-PKI-DPAPIMasterKeys, ms-PKI-AccountCredentials, and msPKI-CredentialRoamingTokens.
 12"""
 13from = "now-9m"
 14index = ["logs-system.security*", "logs-windows.forwarded*", "winlogbeat-*"]
 15language = "eql"
 16license = "Elastic License v2"
 17name = "Access to a Sensitive LDAP Attribute"
 18references = [
 19    "https://cloud.google.com/blog/topics/threat-intelligence/apt29-windows-credential-roaming",
 20    "https://social.technet.microsoft.com/wiki/contents/articles/11483.windows-credential-roaming.aspx",
 21    "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662",
 22]
 23risk_score = 47
 24rule_id = "764c9fcd-4c4c-41e6-a0c7-d6c46c2eff66"
 25setup = """## Setup
 26
 27Audit Directory Service Access must be enabled to generate the events used by this rule.
 28Setup instructions: https://ela.st/audit-directory-service-access
 29"""
 30severity = "medium"
 31tags = [
 32    "Domain: Endpoint",
 33    "OS: Windows",
 34    "Use Case: Threat Detection",
 35    "Tactic: Credential Access",
 36    "Tactic: Privilege Escalation",
 37    "Use Case: Active Directory Monitoring",
 38    "Data Source: Active Directory",
 39    "Data Source: Windows Security Event Logs",
 40    "Resources: Investigation Guide",
 41    "Noise: High",
 42    "Performance: Normal",
 43    "Profile: Aggressive",
 44    "Rule Type: Event Correlation (EQL)",
 45    "Platform: Windows",
 46]
 47timestamp_override = "event.ingested"
 48type = "eql"
 49
 50query = '''
 51any where host.os.type == "windows" and event.code == "4662" and
 52
 53  winlog.event_data.AccessMask in ("0x10") and
 54
 55  not winlog.event_data.SubjectUserSid : "S-1-5-18" and
 56
 57  winlog.event_data.Properties : (
 58  /* ms-PKI-AccountCredentials */
 59  "*b8dfa744-31dc-4ef1-ac7c-84baf7ef9da7*",
 60
 61  /* ms-PKI-DPAPIMasterKeys */
 62  "*b3f93023-9239-4f7c-b99c-6745d87adbc2*",
 63
 64  /* msPKI-CredentialRoamingTokens */
 65  "*b7ff5a38-0818-42b0-8110-d3d154c97f24*"
 66  )
 67'''
 68note = """## Triage and analysis
 69
 70> **Disclaimer**:
 71> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 72
 73### Investigating Access to a Sensitive LDAP Attribute
 74
 75LDAP (Lightweight Directory Access Protocol) is crucial for accessing and managing directory information in Active Directory environments. Adversaries may exploit LDAP to access sensitive attributes like passwords and decryption keys, facilitating credential theft or privilege escalation. The detection rule identifies unauthorized access attempts by monitoring specific event codes and attribute identifiers, excluding benign activities to reduce noise, thus highlighting potential security threats.
 76
 77### Possible investigation steps
 78
 79- Review the event logs for event code 4662 to identify the specific user or process attempting to access the sensitive LDAP attributes.
 80- Check the winlog.event_data.SubjectUserSid to determine the identity of the user or service account involved in the access attempt, excluding the well-known SID S-1-5-18 (Local System).
 81- Analyze the winlog.event_data.Properties field to confirm which sensitive attribute was accessed, such as ms-PKI-DPAPIMasterKeys, ms-PKI-AccountCredentials, or msPKI-CredentialRoamingTokens.
 82- Investigate the context of the access attempt by correlating the event with other logs or alerts around the same timestamp to identify any suspicious patterns or activities.
 83- Verify the legitimacy of the access by checking if the user or process has a valid reason or permission to access the sensitive attributes, considering the organization's access control policies.
 84- Assess the potential impact of the access attempt on the organization's security posture, focusing on credential theft or privilege escalation risks.
 85- Document findings and, if necessary, escalate the incident to the appropriate security team for further action or remediation.
 86
 87### False positive analysis
 88
 89- Access by legitimate administrative accounts: Regular access by system administrators to sensitive LDAP attributes can trigger alerts. To manage this, create exceptions for known administrative accounts by excluding their SIDs from the detection rule.
 90- Scheduled system processes: Automated tasks or system processes that require access to certain LDAP attributes may cause false positives. Identify these processes and exclude their specific event codes or AccessMasks if they are consistently benign.
 91- Service accounts: Service accounts that perform routine directory operations might access sensitive attributes as part of their normal function. Exclude these accounts by adding their SIDs to the exception list to prevent unnecessary alerts.
 92- Monitoring tools: Security or monitoring tools that scan directory attributes for compliance or auditing purposes can generate false positives. Whitelist these tools by excluding their event sources or specific actions from the detection criteria.
 93
 94### Response and remediation
 95
 96- Immediately isolate the affected system from the network to prevent further unauthorized access or data exfiltration.
 97- Conduct a thorough review of the access logs to identify any unauthorized users or systems that accessed the sensitive LDAP attributes.
 98- Reset passwords and revoke any potentially compromised credentials associated with the affected accounts, focusing on those with access to sensitive attributes.
 99- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine the scope of the breach.
100- Implement additional monitoring on the affected systems and accounts to detect any further suspicious activities or attempts to access sensitive LDAP attributes.
101- Review and update access controls and permissions for sensitive LDAP attributes to ensure they are restricted to only necessary personnel.
102- Conduct a post-incident analysis to identify any gaps in security controls and update policies or procedures to prevent similar incidents in the future."""
103
104
105[[rule.threat]]
106framework = "MITRE ATT&CK"
107
108[[rule.threat.technique]]
109id = "T1003"
110name = "OS Credential Dumping"
111reference = "https://attack.mitre.org/techniques/T1003/"
112
113[[rule.threat.technique]]
114id = "T1552"
115name = "Unsecured Credentials"
116reference = "https://attack.mitre.org/techniques/T1552/"
117
118[[rule.threat.technique.subtechnique]]
119id = "T1552.004"
120name = "Private Keys"
121reference = "https://attack.mitre.org/techniques/T1552/004/"
122
123[[rule.threat.technique]]
124id = "T1649"
125name = "Steal or Forge Authentication Certificates"
126reference = "https://attack.mitre.org/techniques/T1649/"
127
128[rule.threat.tactic]
129id = "TA0006"
130name = "Credential Access"
131reference = "https://attack.mitre.org/tactics/TA0006/"
132
133[[rule.threat]]
134framework = "MITRE ATT&CK"
135
136[[rule.threat.technique]]
137id = "T1078"
138name = "Valid Accounts"
139reference = "https://attack.mitre.org/techniques/T1078/"
140
141[[rule.threat.technique.subtechnique]]
142id = "T1078.002"
143name = "Domain Accounts"
144reference = "https://attack.mitre.org/techniques/T1078/002/"
145
146[rule.threat.tactic]
147id = "TA0004"
148name = "Privilege Escalation"
149reference = "https://attack.mitre.org/tactics/TA0004/"
150
151[[rule.threat]]
152framework = "MITRE ATT&CK"
153
154[[rule.threat.technique]]
155id = "T1213"
156name = "Data from Information Repositories"
157reference = "https://attack.mitre.org/techniques/T1213/"
158
159[rule.threat.tactic]
160id = "TA0009"
161name = "Collection"
162reference = "https://attack.mitre.org/tactics/TA0009/"