Modification of the msPKIAccountCredentials

calendar Mar 11, 2024 · Domain: Endpoint OS: Windows Use Case: Threat Detection Data Source: Active Directory Tactic: Privilege Escalation Use Case: Active Directory Monitoring  ·
Share on: linkedin copy

Identify the modification of the msPKIAccountCredentials attribute in an Active Directory User Object. Attackers can abuse the credentials roaming feature to overwrite an arbitrary file for privilege escalation. ms-PKI-AccountCredentials contains binary large objects (BLOBs) of encrypted credential objects from the credential manager store, private keys, certificates, and certificate requests.

Elastic rule (View on GitHub)

 1[metadata]
 2creation_date = "2022/11/09"
 3integration = ["system", "windows"]
 4maturity = "production"
 5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 6min_stack_version = "8.3.0"
 7updated_date = "2023/10/23"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Identify the modification of the msPKIAccountCredentials attribute in an Active Directory User Object. Attackers can
13abuse the credentials roaming feature to overwrite an arbitrary file for privilege escalation. ms-PKI-AccountCredentials
14contains binary large objects (BLOBs) of encrypted credential objects from the credential manager store, private keys,
15certificates, and certificate requests.
16"""
17from = "now-9m"
18index = ["winlogbeat-*", "logs-system.*", "logs-windows.*"]
19language = "kuery"
20license = "Elastic License v2"
21name = "Modification of the msPKIAccountCredentials"
22references = [
23    "https://www.mandiant.com/resources/blog/apt29-windows-credential-roaming",
24    "https://social.technet.microsoft.com/wiki/contents/articles/11483.windows-credential-roaming.aspx",
25    "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136",
26]
27risk_score = 47
28rule_id = "670b3b5a-35e5-42db-bd36-6c5b9b4b7313"
29setup = """## Setup
30
31The 'Audit Directory Service Changes' logging policy must be configured for (Success, Failure).
32Steps to implement the logging policy with Advanced Audit Configuration:

Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policies Configuration > Audit Policies > DS Access > Audit Directory Service Changes (Success,Failure)

 1"""
 2severity = "medium"
 3tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Data Source: Active Directory", "Tactic: Privilege Escalation", "Use Case: Active Directory Monitoring"]
 4timestamp_override = "event.ingested"
 5type = "query"
 6
 7query = '''
 8event.action:"Directory Service Changes" and event.code:"5136" and
 9  winlog.event_data.AttributeLDAPDisplayName:"msPKIAccountCredentials" and winlog.event_data.OperationType:"%%14674" and
10  not winlog.event_data.SubjectUserSid : "S-1-5-18"
11'''
12
13
14[[rule.threat]]
15framework = "MITRE ATT&CK"
16[[rule.threat.technique]]
17id = "T1068"
18name = "Exploitation for Privilege Escalation"
19reference = "https://attack.mitre.org/techniques/T1068/"
20
21
22[rule.threat.tactic]
23id = "TA0004"
24name = "Privilege Escalation"
25reference = "https://attack.mitre.org/tactics/TA0004/"

References

Related rules

to-top