Possible Shadow Credentials Added

calendar Oct 18, 2023 · attack.credential_access attack.t1556  ·
Share on: linkedin copy

Detects possible addition of shadow credentials to an active directory object.

Sigma rule (View on GitHub)

 1title: Possible Shadow Credentials Added
 2id: f598ea0c-c25a-4f72-a219-50c44411c791
 3status: test
 4description: Detects possible addition of shadow credentials to an active directory object.
 5references:
 6    - https://www.elastic.co/guide/en/security/8.4/potential-shadow-credentials-added-to-ad-object.html
 7    - https://cyberstoph.org/posts/2022/03/detecting-shadow-credentials/
 8    - https://twitter.com/SBousseaden/status/1581300963650187264?
 9author: Nasreddine Bencherchali (Nextron Systems), Elastic (idea)
10date: 2022/10/17
11tags:
12    - attack.credential_access
13    - attack.t1556
14logsource:
15    product: windows
16    service: security
17    definition: The "Audit Directory Service Changes" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule)
18detection:
19    selection:
20        EventID: 5136
21        AttributeLDAPDisplayName: 'msDS-KeyCredentialLink'
22        # If you experience a lot of FP you could uncomment the selection below
23        # There could be other cases for other tooling add them accordingly
24        # AttributeValue|contains: 'B:828'
25        # OperationType: '%%14674' # Value Added
26    # As stated in the FP sections it's better to filter out the expected accounts that perform this operation to tighten the logic
27    # Uncomment the filter below and add the account name (or any other specific field) accordingly
28    # Don't forget to add it to the condition section below
29    # filter:
30        # SubjectUserName: "%name%"
31    condition: selection
32falsepositives:
33    - Modifications in the msDS-KeyCredentialLink attribute can be done legitimately by the Azure AD Connect synchronization account or the ADFS service account. These accounts can be added as Exceptions. (From elastic FP section)
34level: high

References

  • Potential Shadow Credentials added to AD Object | Elastic Security Solution [8.4] | Elastic

    Potential Shadow Credentials added to AD Objectedit Identify the modification of the msDS-KeyCredentialLink attribute in an Active Directory Computer or User Object. Attackers can abuse control ove...


    Read More

  • Detecting shadow credentials :: Cyberstoph's blog — Cyberstoph's Blog

    A defenders perspective on msDS-KeyCredentialLink TL;DR; This article is about my journey into tracing changes to the msDS-KeyCredentialLink attribute to verify if their origin is legitimate or a potential attack (aka. Shadow Credentials). If you just want to know the “gist” of it, scroll down to the bottom and you’ll find a mindmap. What’s msDS-KeyCredentialLink and why should I care? The msDS-KeyCredentialLink (aka. “kcl”) attribute can be used to link an RSA key pair with a computer or user object in order to authenticate with said key pair against the KDC to receive a Kerberos TGT.


    Read More

  • Something went wrong, but don’t fret — let’s give it another shot.


    Read More

Related rules

to-top