Group Policy Abuse for Privilege Addition

 1[metadata]
 2creation_date = "2021/11/08"
 3integration = ["system", "windows"]
 4maturity = "production"
 5updated_date = "2024/10/15"
 6min_stack_version = "8.14.0"
 7min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or
13use them to add users as local admins.
14"""
15index = ["winlogbeat-*", "logs-system.*", "logs-windows.*"]
16language = "eql"
17license = "Elastic License v2"
18name = "Group Policy Abuse for Privilege Addition"
19note = """## Triage and analysis
20
21### Investigating Group Policy Abuse for Privilege Addition
22
23Group Policy Objects (GPOs) can be used to add rights and/or modify Group Membership on GPOs by changing the contents of an INF file named GptTmpl.inf, which is responsible for storing every setting under the Security Settings container in the GPO. This file is unique for each GPO, and only exists if the GPO contains security settings. Example Path: "\\\\DC.com\\SysVol\\DC.com\\Policies\\{PolicyGUID}\\Machine\\Microsoft\\Windows NT\\SecEdit\\GptTmpl.inf"
24
25#### Possible investigation steps
26
27- This attack abuses a legitimate mechanism of Active Directory, so it is important to determine whether the activity is legitimate and the administrator is authorized to perform this operation.
28- Retrieve the contents of the `GptTmpl.inf` file, and under the `Privilege Rights` section, look for potentially dangerous high privileges, for example: SeTakeOwnershipPrivilege, SeEnableDelegationPrivilege, etc.
29- Inspect the user security identifiers (SIDs) associated with these privileges, and if they should have these privileges.
30
31### False positive analysis
32
33- Inspect whether the user that has done the modifications should be allowed to. The user name can be found in the `winlog.event_data.SubjectUserName` field.
34
35### Related rules
36
37- Scheduled Task Execution at Scale via GPO - 15a8ba77-1c13-4274-88fe-6bd14133861e
38- Startup/Logon Script added to Group Policy Object - 16fac1a1-21ee-4ca6-b720-458e3855d046
39
40### Response and remediation
41
42- Initiate the incident response process based on the outcome of the triage.
43- The investigation and containment must be performed in every computer controlled by the GPO, where necessary.
44- Remove the script from the GPO.
45- Check if other GPOs have suspicious scripts attached.
46"""
47references = [
48    "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0025_windows_audit_directory_service_changes.md",
49    "https://labs.f-secure.com/tools/sharpgpoabuse",
50]
51risk_score = 73
52rule_id = "b9554892-5e0e-424b-83a0-5aef95aa43bf"
53setup = """## Setup
54
55The 'Audit Directory Service Changes' audit policy must be configured (Success Failure).
56Steps to implement the logging policy with Advanced Audit Configuration:

 1"""
 2severity = "high"
 3tags = [
 4    "Domain: Endpoint",
 5    "OS: Windows",
 6    "Use Case: Threat Detection",
 7    "Tactic: Privilege Escalation",
 8    "Data Source: Active Directory",
 9    "Resources: Investigation Guide",
10    "Use Case: Active Directory Monitoring",
11    "Data Source: System",
12]
13timestamp_override = "event.ingested"
14type = "eql"
15
16query = '''
17any where host.os.type == "windows" and event.code: "5136" and
18  winlog.event_data.AttributeLDAPDisplayName: "gPCMachineExtensionNames" and
19  winlog.event_data.AttributeValue: "*827D319E-6EAC-11D2-A4EA-00C04F79F83A*" and
20  winlog.event_data.AttributeValue: "*803E14A0-B4FB-11D0-A0D0-00A0C90F574B*"
21'''
22
23
24[[rule.threat]]
25framework = "MITRE ATT&CK"
26[[rule.threat.technique]]
27id = "T1484"
28name = "Domain or Tenant Policy Modification"
29reference = "https://attack.mitre.org/techniques/T1484/"
30[[rule.threat.technique.subtechnique]]
31id = "T1484.001"
32name = "Group Policy Modification"
33reference = "https://attack.mitre.org/techniques/T1484/001/"
34
35
36
37[rule.threat.tactic]
38id = "TA0004"
39name = "Privilege Escalation"
40reference = "https://attack.mitre.org/tactics/TA0004/"