Manipulation of User Computer or Group Security Principals Across AD
Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain..
Sigma rule (View on GitHub)
1title: Manipulation of User Computer or Group Security Principals Across AD
2id: b29a93fb-087c-4b5b-a84d-ee3309e69d08
3status: test
4description: |
5 Adversaries may create a domain account to maintain access to victim systems.
6 Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain..
7references:
8 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1136.002/T1136.002.md#atomic-test-3---create-a-new-domain-account-using-powershell
9 - https://docs.microsoft.com/en-us/dotnet/api/system.directoryservices.accountmanagement?view=dotnet-plat-ext-6.0
10author: frack113
11date: 2021/12/28
12tags:
13 - attack.persistence
14 - attack.t1136.002
15logsource:
16 product: windows
17 category: ps_script
18 definition: 'Requirements: Script Block Logging must be enabled'
19detection:
20 selection:
21 ScriptBlockText|contains: System.DirectoryServices.AccountManagement
22 condition: selection
23falsepositives:
24 - Legitimate administrative script
25level: medium
References
-
Small and highly portable detection tests based on MITRE's ATT&CK. - redcanaryco/atomic-red-team
Read More -
Provides uniform access and manipulation of user, computer, and group security principals across the multiple principal stores: Active Directory Domain Services (AD DS), Active Directory Lightweight Directory Services (AD LDS), and Machine SAM (MSAM). System.DirectoryServices.AccountManagement manages directory objects independent of the System.DirectoryServices namespace.
Read More
Related rules
- Suspicious Windows ANONYMOUS LOGON Local Account Created
- Code Executed Via Office Add-in XLL File
- Creation Exe for Service with Unquoted Path
- Powershell Create Scheduled Task
- Powershell LocalAccount Manipulation