New ActiveSyncAllowedDeviceID Added via PowerShell

 1[metadata]
 2creation_date = "2020/12/15"
 3integration = ["endpoint", "windows"]
 4maturity = "production"
 5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 6min_stack_version = "8.3.0"
 7updated_date = "2024/03/28"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Identifies the use of the Exchange PowerShell cmdlet, Set-CASMailbox, to add a new ActiveSync allowed device.
13Adversaries may target user email to collect sensitive information.
14"""
15false_positives = ["Legitimate exchange system administration activity."]
16from = "now-9m"
17index = ["logs-endpoint.events.process-*", "winlogbeat-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
18language = "eql"
19license = "Elastic License v2"
20name = "New ActiveSyncAllowedDeviceID Added via PowerShell"
21references = [
22    "https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/",
23    "https://docs.microsoft.com/en-us/powershell/module/exchange/set-casmailbox?view=exchange-ps",
24]
25risk_score = 47
26rule_id = "ce64d965-6cb0-466d-b74f-8d2c76f47f05"
27setup = """## Setup
28
29If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
30events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
31Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
32`event.ingested` to @timestamp.
33For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
34"""
35severity = "medium"
36tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Tactic: Execution", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"]
37timestamp_override = "event.ingested"
38type = "eql"
39
40query = '''
41process where host.os.type == "windows" and event.type == "start" and
42  process.name: ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and process.args : "Set-CASMailbox*ActiveSyncAllowedDeviceIDs*"
43'''
44
45
46[[rule.threat]]
47framework = "MITRE ATT&CK"
48[[rule.threat.technique]]
49id = "T1098"
50name = "Account Manipulation"
51reference = "https://attack.mitre.org/techniques/T1098/"
52[[rule.threat.technique.subtechnique]]
53id = "T1098.002"
54name = "Additional Email Delegate Permissions"
55reference = "https://attack.mitre.org/techniques/T1098/002/"
56
57
58
59[rule.threat.tactic]
60id = "TA0003"
61name = "Persistence"
62reference = "https://attack.mitre.org/tactics/TA0003/"
63
64[[rule.threat]]
65framework = "MITRE ATT&CK"
66[[rule.threat.technique]]
67id = "T1059"
68name = "Command and Scripting Interpreter"
69reference = "https://attack.mitre.org/techniques/T1059/"
70[[rule.threat.technique.subtechnique]]
71id = "T1059.001"
72name = "PowerShell"
73reference = "https://attack.mitre.org/techniques/T1059/001/"
74
75
76
77[rule.threat.tactic]
78id = "TA0002"
79name = "Execution"
80reference = "https://attack.mitre.org/tactics/TA0002/"