Active Directory Replication from Non Machine Account

 1title: Active Directory Replication from Non Machine Account
 2id: 17d619c1-e020-4347-957e-1d1207455c93
 3status: test
 4description: Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.
 5references:
 6    - https://threathunterplaybook.com/hunts/windows/180815-ADObjectAccessReplication/notebook.html
 7    - https://threathunterplaybook.com/library/windows/active_directory_replication.html
 8    - https://threathunterplaybook.com/hunts/windows/190101-ADModDirectoryReplication/notebook.html
 9author: Roberto Rodriguez @Cyb3rWard0g
10date: 2019/07/26
11modified: 2021/11/27
12tags:
13    - attack.credential_access
14    - attack.t1003.006
15logsource:
16    product: windows
17    service: security
18detection:
19    selection:
20        EventID: 4662
21        AccessMask: '0x100'
22        Properties|contains:
23            - '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2'
24            - '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2'
25            - '89e95b76-444d-4c62-991a-0facbeda640c'
26    filter:
27        - SubjectUserName|endswith: '$'
28        - SubjectUserName|startswith: 'MSOL_' # https://docs.microsoft.com/en-us/azure/active-directory/hybrid/reference-connect-accounts-permissions#ad-ds-connector-account
29    condition: selection and not filter
30fields:
31    - ComputerName
32    - SubjectDomainName
33    - SubjectUserName
34falsepositives:
35    - Unknown
36level: critical

References

• Active Directory Object Access via Replication Services — Threat Hunter Playbook

  Offensive Tradecraft An adversary can abuse this model and request information about a specific account via the replication request. This is done from an account with sufficient permissions (usuall...

  
  Read More

• Active Directory Replication — Threat Hunter Playbook

  Active Directory Replication Active Directory replication is the process by which the changes that originate on one domain controller are automatically transferred to other domain controllers that ...

  
  Read More

• Active Directory Root Domain Modification for Replication Services — Threat Hunter Playbook

  Offensive Tradecraft An adversary with enough permissions (domain admin) can add an ACL to the Root Domain for any user, despite being in no privileged groups, having no malicious sidHistory, and n...

  
  Read More

Related rules

• HackTool - Mimikatz Execution
• Credential Dumping Tools Service Execution - System
• Mimikatz DC Sync
• Possible Impacket Secretsdump.py Activity
• Credential Dumping Tools Service Execution - Security