Windows Analytics¶

LP_AD: Computer Account Management¶

Widgets available in the LP_AD: Computer Account Management dashboard provide details of Audit Computer Account Management events. When a computer account is established, modified, or deleted, Audit Computer Account Management tells you if the operating system creates audit events.

LP_AD: Critical User Activities¶

Widgets available in the LP_AD: Critical User Activities dashboard provide details of users added, removed, enabled, disabled, or created in the Active Directory Security Groups. Active Directory includes security groups (Administrators), who are provided permission to shared resources. Members of the Administrators group have total and unrestricted access to the resources.

LP_AD: Distribution Group Management¶

Widgets available in the LP_AD: Distribution Group Management dashboard provide details of users or groups in Active Directory Distribution Group Management. Distribution Groups are created to distribute messages in your organization.

LP_AD: Machine Authentication Requests¶

Widgets available in the LP_AD: Machine Authentication Requests dashboard provide details of machines or services authenticated by Kerberos authentication protocol. Kerberos is a protocol to authenticate service requests between trustworthy hosts over an untrusted network, such as the internet. All popular computer operating systems, including Microsoft Windows, Apple macOS, FreeBSD and Linux, provide built-in Kerberos compatibility.

LP_AD: OU and GPO¶

Widgets available in LP_AD: OU and GPO provide details of Organizational Unit (OU) and Group Policy Object (GPO). In Active Directory, OUs are the containers where users, groups, and machines are stored. Group Policy Objects (GPOs) are a set of guidelines that regulate how user and computer accounts operate. The lowest scope or unit to which you may assign Group Policy settings or delegate administrative responsibility is an organizational unit.

LP_AD: Policy Changes¶

Widgets available in the LP_AD: Policy Changes dashboard provide details on Active Directory audit policy, user rights, logon rights and domain policy.

LP_AD: Security Group Management¶

Widgets available in the LP_AD: Security Group Management dashboard provide details on Security Group Management that keeps track of activities like the creation, deletion, or modification of security-enabled groups, as well as any changes to the membership of the groups. Security-enabled groups are used for permissions, rights and as distribution lists.

LP_AD: Service¶

Widgets available in the LP_AD: Service dashboard provide details on changes made in Domain Policy, System Audit Policy or Kerberos Policy.

LP_AD: User Account Management¶

Widgets available in LP_AD: User Account Management provide:

LP_AD: User Authentication Requests¶

Widgets available in LP_AD: User Authentication Requests provide:

LP_Windows Antimalware¶

Widgets available in LP_Windows Antimalware provide:

LP_Windows Authentication¶

Widgets available in LP_Windows Authentication provide:

LP_Windows Configuration¶

Widgets available in LP_Windows Configuration provide:

LP_Windows DHCP¶

Widgets available in LP_Windows DHCP provide:

LP_Windows DNS¶

Widgets available in LP_Windows DNS provide:

LP_Windows File Auditing¶

Widgets available in LP_Windows File Audit provide:

LP_Windows Overview¶

Widgets available in LP_Windows Overview provide:

LP_Windows Sysmon Overview¶

Widgets available in the LP_Windows Sysmon Overview dashboard provide details of the Windows Sysmon events.

LP_ADFS Auditing¶

Widgets available in LP_ADFS Auditing dashboard provide details of Windows Active Directory Federation System events.

LP_Windows BITS¶

Widgets available in LP_Windows BITS provide:

LP_AppLocker¶

Widgets available in LP_AppLocker provide:

LP_Windows Service Control Manager¶

Widgets available in LP_Windows Service Control Manager provide:

Adding the Windows Dashboard¶

1. Go to Settings >> Knowledge Base from the navigation bar and click Dashboards.

2. Select VENDOR DASHBOARD from the drop-down.

3. Click the Use icon from Actions of a required dashboard.

4. Click Choose Repos.

Selecting Repos¶

5. Select the repo configured to store the Windows logs and click Done.

Selecting Repos¶

6. Select the dashboard and click Ok.

You can find the Windows dashboards under Dashboards.

Windows Dashboard¶

Windows Dashboard¶

LP_Possible Pass the Hash Activity Detected¶

• Trigger Condition: Use of pass-the-hash attack technique to move laterally inside the network.

• ATT&CK Category: Lateral Movement, Defense Evasion

• ATT&CK Tag: Use Alternate Authentication Material, Pass the Hash

• ATT&CK ID: T1550, T1550.002

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer event_id=4624 ((caller_id="S-1-0-0" logon_type="3" logon_process="NtLmSsp" key_length="0") OR (logon_type="9" logon_process="seclogo")) -user="ANONYMOUS LOGON" -user IN EXCLUDED_USERS
  

LP_Windows Directory Service State Change¶

• Trigger Condition: Changes in the state of any directory objects/services except domain or OU.

• ATT&CK Category: Privilege Escalation, Persistence

• ATT&CK Tag: Create or Modify System Process, Windows Service

• ATT&CK ID: T1543, T1543.003

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer label=Service label=Directory (label=Delete OR label=Create OR label=Change OR label=Start OR label=Stop) -class IN ["domainDNS","organizationalUnit"] -user IN EXCLUDED_USERS
  

LP_Windows unBlock Inheritance on OU or Domain¶

• Trigger Condition: Inheritance is set to unblock on OU or domain. Unblocking inheritance allows the settings in GPOs that are linked to higher-level sites, domains, or organizational units to automatically be inherited by the specified domain or OU unless the link for a GPO is enforced.

• ATT&CK Category: Privilege Escalation, Defense Evasion

• ATT&CK Tag: Group Policy Modification, Domain Policy Modification

• ATT&CK ID: T1484.001, T1484

• Minimum Log Source Requirement: Windows, Windows Sysmon

• Query:

  label=Change label=Service label=Directory (value=0 OR attribute_value=0) class IN ["domainDNS", "organizationalUnit"] -user IN EXCLUDED_USERS
  

LP_Windows Users Enabled¶

• Trigger Condition: User is enabled with the event ID 4722.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: _

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer label=Enable label=Management label=Account label=User -user IN EXCLUDED_USERS
  

LP_Windows Group Policy Object Creation¶

• Trigger Condition: Creation of a Group Policy Object.

• ATT&CK Category: Defense Evasion, Privilege Escalation

• ATT&CK Tag: Group Policy Modification, Domain Policy Modification

• ATT&CK ID: T1484.001, T1484

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer label=Create label=Object label=Service label=Directory class="groupPolicyContainer" -user IN EXCLUDED_USERS
  

LP_Windows User Password Never Expires¶

• Trigger Condition: User account granted the password never expires right with event ID 4738.

• ATT&CK Category: Persistence

• ATT&CK Tag: Account Manipulation

• ATT&CK ID: T1098

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer label=Change label=Management label=Account label=User user_account_control="*Don't Expire Password - Enabled" -target_user=*$ -user IN EXCLUDED_USERS | rename caller_user as user, caller_domain as domain
  

LP_Windows User Added to Administrator Group¶

• Trigger Condition: A user is added to an administrative group or a security group.

• ATT&CK Category: Persistence, Privilege Escalation

• ATT&CK Tag: Account Manipulation, Local Accounts

• ATT&CK ID: T1098, T1078.003

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer (group="*Admins" OR group=Administrators) label=Add label=Member label=Management label=Group label=Security -user IN EXCLUDED_USERS
  

LP_Windows OU Deletion¶

• Trigger Condition: Deletion of OU is created with the event ID 5141.

• ATT&CK Category: Defense Evasion

• ATT&CK Tag: Domain Policy Modification

• ATT&CK ID: T1484

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer label=Delete label=Object label=Service label=Directory class="organizationalUnit" -user IN EXCLUDED_USERS
  

LP_Windows Successful Brute Force Attack from Same User¶

• Trigger Condition: More than the 10 failed login attempts are detected followed by a successful login from the same user.

• ATT&CK Category: Credential Access

• ATT&CK Tag: Brute Force

• ATT&CK ID: T1110

• Minimum Log Source Requirement: Windows

• Query:

  [ 10 norm_id=WinServer* label=User label=Login label=Fail -user IN EXCLUDED_USERS | rename target_user as user having same user ] as s1 followed by [norm_id=WinServer* label=User label=Login label=Successful | rename target_user as user] as s2 within 5 minute on s1.user = s2.user | rename s2.user as User
  

LP_Windows User Rights Changes¶

• Trigger Condition: User rights are changed with the event IDs 4704 and 4705.

• ATT&CK Category: Privilege Escalation

• ATT&CK Tag: Domain Policy Modification

• ATT&CK ID: T1484

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer event_id IN ["4704", "4705"] -user_id="S-1-5-18" -user IN EXCLUDED_USERS
  

LP_Windows User Removed from Administrator Group¶

• Trigger Condition: User is removed from an administrative group or a security group.

• ATT&CK Category: Persistence, Defense Evasion

• ATT&CK Tag: Account Manipulation, Indicator Removal, Clear Persistence

• ATT&CK ID: T1098, T1070, T1070.009

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer (group="*Admins" OR group=Administrators) label=Remove label=Member label=Management label=Group label=Security -user IN EXCLUDED_USERS
  

LP_Windows Block Inheritance on OU¶

• Trigger Condition: Inheritance is set to block an OU.

• ATT&CK Category: Credential Access, Persistence, Defense Evasion

• ATT&CK Tag: Group Policy Modification, Domain Policy Modification

• ATT&CK ID: T1098, T1484

• Minimum Log Source Requirement: Windows

• Query:

  (norm_id=WinServer* OR MSWinEventLog) label=Change label=Service label=Directory class="organizationalUnit" value=1 or attribute_value=1 -user IN EXCLUDED_USERS | rename value as attribute_value, acl_change as ldap_display, type as operation_type
  

LP_Windows Kerberos Pre-authentication failed¶

• Trigger Condition: Failure of Kerberos Service Ticket Pre-Authentication.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer* label=Kerberos label=User label=Fail label=Authentication -user IN EXCLUDED_USERS
  

LP_Windows User Added or Remove from Group¶

• Trigger Condition: Addition or removal of a member from a group.

• ATT&CK Category: Persistence, Defense Evasion

• ATT&CK Tag: Indicator Removal, Clear Persistence, Account Manipulation

• ATT&CK ID: T1070, T1070.009, T1098

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer label=Group (label=Remove or label=Add) -user IN EXCLUDED_USERS
  

LP_Windows Password Never Expires¶

• Trigger Condition: User is granted the password never expires right with the event ID 4738.

• ATT&CK Category: Persistence, Credential Access, Defense Evasion

• ATT&CK Tag: Account Manipulation, Valid Accounts, Abuse Elevation Control Mechanism, Bypass User Access Control

• ATT&CK ID: T1098, T1078, T1548

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer* label=Change label=Management label=Account label=User user_account_control="*Don't Expire Password - Enabled" -target_user=*$ -user IN EXCLUDED_USERS | rename caller_user as user, caller_domain as domain
  

LP_Windows User Account was Created with a Dollar Sign¶

• Trigger Condition: Creation of a user account ending with the dollar sign ($).

• ATT&CK Category: Persistence

• ATT&CK Tag: Create Account

• ATT&CK ID: T1136

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer* label=User label=Account label=Create target_user=*$ -user IN EXCLUDED_USERS | rename caller_user as user, caller_domain as domain
  

LP_Windows Failed Login Followed by Lockout Event¶

• Trigger Condition: Failed login attempt followed by account lockout.

• ATT&CK Category: Defense Evasion, Persistence, Privilege Escalation, Initial Access, Credential Access

• ATT&CK Tag: Valid Accounts, Brute Force

• ATT&CK ID: T1078, T1110

• Minimum Log Source Requirement: Windows

• Query:

  [norm_id=WinServer label=User label=Login label=Fail -user IN EXCLUDED_USERS] as s1 followed by [norm_id=WinServer label=User label=Account label=Management label=Lock user=* -user=*$] as s2 within 1 minute on s1.user=s2.user | rename s1.caller_user as caller_user, s1.source_address as source_address, s2.host as host, s1.caller_domain as caller_domain, s2.target_domain as target_domain, s1.log_ts as last_failed_login_ts, s2.log_ts as locked_out_ts
  

LP_Windows Kerberos Service Ticket Request¶

• Trigger Condition: Kerberos Service Ticket request is logged.

• ATT&CK Category: Defense Evasion, Persistence, Privilege Escalation, Initial Access

• ATT&CK Tag: Valid Accounts

• ATT&CK ID: T1078

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer* label=Kerberos label=Service label=Request result_code=* OR status_code=* -user IN EXCLUDED_USERS | rename result_code as status_code
  

LP_Windows Logon Rights Changes¶

• Trigger Condition: Logon rights such as “Access this computer from the network” or “Logon as a service” are changed.

• ATT&CK Category: Persistence, Defense Evasion, Privilege Escalation

• ATT&CK Tag: Account Manipulation, Group Policy Modification, Domain Policy Modification

• ATT&CK ID: T1098, T1484.001, T1484

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer* (event_id=4717 OR event_id=4718) (rights=* OR privilege=*) -user="ANONYMOUS LOGON" -user IN EXCLUDED_USERS | rename rights as privilege, caller_user as user
  

LP_Windows Successful Remote Interactive Login¶

• Trigger Condition: A remote interactive login event is detected.

• ATT&CK Category: Lateral Movement

• ATT&CK Tag: Remote Services, Remote Desktop Protocol

• ATT&CK ID: T1021, T1021.001

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer* label=User label=Login label=Successful logon_type=10 - target_user=*−user=∗−user=∗ -user IN EXCLUDED_USERS | rename target_user as user, target_domain as domain
  

LP_Windows unBlock Inheritance on OU and Domain¶

• Trigger Condition: Inheritance is set to unblock on an OU or domain.

• ATT&CK Category: Defense Evasion, Privilege Escalation

• ATT&CK Tag: Domain Policy Modification, Group Policy Modification

• ATT&CK ID: T1484, T1484.001

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer* label=Change label=Service label=Directory (value=0 OR attribute_value=0) -user IN EXCLUDED_USERS
  

LP_Windows Block Inheritance on OU and Domain¶

• Trigger Condition: Inheritance is set to block an OU and domain.

• ATT&CK Category: Credential Access, Persistence, Defense Evasion

• ATT&CK Tag: Account Manipulation, Group Policy Modification, Abuse Elevation Control Mechanism, Bypass User Access Control

• ATT&CK ID: T1098, T1484, T1548

• Minimum Log Source Requirement: Windows

• Query:

  (norm_id=WinServer* OR MSWinEventLog) label=Change label=Service label=Directory value=1 or attribute_value=1 -user IN EXCLUDED_USERS | rename value as attribute_value, acl_change as ldap_display, type as operation_type
  

LP_Windows Failed Login Attempts using Disabled Account¶

• Trigger Condition: User attempts to log in using a disabled account.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer* label=User label=Login label=Fail sub_status_code="0xC0000072" -target_user=*−user=∗−user=∗ -user IN EXCLUDED_USERS | rename user as target_user, domain as target_domain, reason as failure_reason
  

LP_Windows Authentication Policy Change¶

• Trigger Condition: Authentication policy is changed.

• ATT&CK Category: Defense Evasion, Privilege Escalation

• ATT&CK Tag: Group Policy , Domain Policy Modification

• ATT&CK ID: T1484.001, T1484

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer label=Authentication label=Policy label=Change (caller_user=* or user=*) -user=*$ -caller_user=*$ -user IN EXCLUDED_USERS | rename caller_user as user
  

LP_Windows Group Policy Object Changes¶

• Trigger Condition: Group Policy Object is changed.

• ATT&CK Category: Privilege Escalation, Defense Evasion

• ATT&CK Tag: Group Policy Modification, Domain Policy Modification

• ATT&CK ID: T1484.001, T1484

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer label=Change label=Directory label=Object label=Service -user=System acl_change="versionNumber" OR ldap_display="versionNumber" class="groupPolicyContainer" -user IN EXCLUDED_USERS | rename acl_change as ldap_display, type as operation_type
  

LP_Windows OU Creation¶

• Trigger Condition: Creation of an organizational units (OU) with the event ID 5137.

• ATT&CK Category: Privilege Escalation, Defense Evasion

• ATT&CK Tag: Domain Policy Modification

• ATT&CK ID: T1484

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer label=Create label=Object label=Service label=Directory (class="organizationalUnit" OR "Class: organizationalUnit") -user IN EXCLUDED_USERS
  

LP_Windows Multiple Unique Lockouts¶

• Trigger Condition: User account is locked out more than once in an hour.

• ATT&CK Category: Credential Access

• ATT&CK Tag: Brute Force, Password Guessing, Password Spraying, Credential Stuffing

• ATT&CK ID: T1110, T1110.001, T1110.003, T1110.004

• Minimum Log Source Requirement: Windows

• Query:

  label=Lock label=Account -target_user=*$ -user=*$ | rename user as target_user| chart count() as cnt by target_user | search cnt>1
  

LP_Windows Successful Brute Force Attack from Same Source¶

• Trigger Condition: More than 10 failed login attempts followed by a successful login from the same source address are detected.

• ATT&CK Category: Credential Access

• ATT&CK Tag: Brute Force

• ATT&CK ID: T1110

• Minimum Log Source Requirement: Windows

• Query:

  [ 10 norm_id=WinServer label=User label=Login label=Fail having same source_address ] as s1 followed by [norm_id=WinServer label=User label=Login label=Successful -user IN EXCLUDED_USERS] as s2 within 10 minute on s1.source_address = s2.source_address | rename s2.user as successful_login_user, s2.host as host, s2.domain as domain, log_ts as last_failed_login_ts, s2.log_ts as successful_login_ts
  

LP_Windows Possible Ransomware Detection¶

• Trigger Condition: File created a large number of new files in a short duration. This alert looks for more than 10 new files created in a minute. For this alert to work, the list KNOWN_FILE is created to remove false positives.

• ATT&CK Category: Impact

• ATT&CK Tag: Data Encrypted for Impact, Data Destruction, Proxy

• ATT&CK ID: T1486, T1485, T1090

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer* label=File label=Create -label=Change (image=* OR file=*) -image IN KNOWN_FILE -file IN KNOWN_FILE -user IN EXCLUDED_USERS | rename image as file | timechart count() as cnt by file every 1 minute | search cnt>10
  

LP_Windows unBlock Inheritance on Domain¶

• Trigger Condition: Inheritance is set to block on the domain.

• ATT&CK Category: Defense Evasion, Privilege Escalation

• ATT&CK Tag: Domain Policy Modification, Group Policy Modification

• ATT&CK ID: T1484, T1484.001

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer* label=Change label=Service label=Directory class="domainDNS" value=0 OR attribute_value=0 -user IN EXCLUDED_USERS
  

LP_Windows User Account Change to End with Dollar Sign¶

• Trigger Condition: User account is changed to end with the dollar sign ($).

• ATT&CK Category: Persistence

• ATT&CK Tag: Account Manipulation

• ATT&CK ID: T1098

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer* label=User label=Account label=Change label=Name new_user=*$ -user IN EXCLUDED_USERS | rename caller_user as user, caller_domain as domain
  

LP_Windows Users Disabled¶

• Trigger Condition: User is disabled with the event ID 4725.

• ATT&CK Category: Persistence, Defense Evasion

• ATT&CK Tag: Indicator Removal, Clear Persistence, Account Manipulation

• ATT&CK ID: T1070, T1070.009, T1098

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer label=Disable label=Management label=Account label=User -user IN EXCLUDED_USERS
  

LP_Windows Audit Logs Cleared¶

• Trigger Condition: Clearance of the Windows security audit log.

• ATT&CK Category: Defense Evasion

• ATT&CK Tag: Clear Windows Event Logs

• ATT&CK ID: T1070.001

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer label=Audit label=Log label=Clear -user IN EXCLUDED_USERS
  

LP_Windows Data Copied to Removable Device¶

• Trigger Condition: File is copied to a removable storage device.

• ATT&CK Category: Exfiltration

• ATT&CK Tag: Exfiltration Over Physical Medium, Exfiltration over USB

• ATT&CK ID: T1052, T1052.001

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer* event_id=4663 event_category="Removable Storage" access="WriteData*" or access="*AppendData*" host IN CRITICAL_HOSTS -user IN EXCLUDED_USERS
  

LP_Windows Bulk Print at a Time¶

• Trigger Condition: 30 or more successful files are printed.

• ATT&CK Category: Exfiltration

• ATT&CK Tag: Exfiltration Over Other Network Medium, Exfiltration Over Physical Medium

• ATT&CK ID: T1011, T1052

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer* label=Print label=Successful -user IN EXCLUDED_USERS | rename file as document | chart distinct_count(document) as DocumentPrinted by user order by DocumentPrinted desc | search DocumentPrinted>30
  

LP_Windows Multiple Failed Attempts against a Single Account¶

• Trigger Condition: More than one failed login attempt is detected against the same account.

• ATT&CK Category: Credential Access

• ATT&CK Tag: Brute Force, Password Guessing, Password Spraying, Credential Stuffing

• ATT&CK ID: T1110, T1110.001, T1110.003, T1110.004

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer label=User label=Login label=Fail -target_user=*$ -user=*$ -user IN EXCLUDED_USERS | chart count() as FailedTimes by user,source_address,host,logon_type,caller_user,caller_domain order by count() desc | search FailedTimes>5
  

LP_Windows Excessive Amount of Files Copied to Removable Device¶

• Trigger Condition: User copied more than 100 files to a removable storage device.

• ATT&CK Category: Exfiltration

• ATT&CK Tag: Exfiltration Over Physical Medium, Exfiltration over USB

• ATT&CK ID: T1052, T1052.001

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer event_id=4663 event_category="Removable Storage" (access_detail="WriteData*" OR access_detail="*AppendData*") -user IN EXCLUDED_USERS | chart distinct_count(object) as DataCopied by user | search DataCopied>100
  

LP_Windows Failed Login Attempt Using Service Account¶

• Trigger Condition: User failed to log in using a service account.

• ATT&CK Category: Defense Evasion, Persistence, Privilege Escalation, Initial Access

• ATT&CK Tag: Valid Accounts

• ATT&CK ID: T1078

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer label=User label=Login label=Fail logon_type = 5 -user=*$ -user in EXCLUDED_USERS
  

LP_Windows User Account Created or Removed¶

• Trigger Condition: User account is created or deleted.

• ATT&CK Category: Persistence, Defense Evasion

• ATT&CK Tag: Clear Persistence, Account Manipulation, Create Account

• ATT&CK ID: T1070.009, T1098, T1136

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer label=User label=Account (label=Create OR label=Delete) -target_user=*$ target_user=* -user IN EXCLUDED_USERS
  

LP_Windows Multiple Account Password Changes by User¶

• Trigger Condition: User changed the password of multiple user accounts.

• ATT&CK Category: Persistence, Impact

• ATT&CK Tag: Account Manipulation, Account Access Removal

• ATT&CK ID: T1098, T1531

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer label=User label=Password (label=Change or label=Reset) -target_user=*$ -caller_user=*$ -user IN EXCLUDED_USERS | rename user as caller_user| chart distinct_count(target_user) as Account by caller_user | search Account > 1
  

LP_Windows Domain Policy Change¶

• Trigger Condition: Domain policy is changed on a Domain Controller.

• ATT&CK Category: Defense Evasion, Privilege Escalation

• ATT&CK Tag: Group Policy Modification

• ATT&CK ID: T1484.001

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer* label=Domain label=Policy label=Change user=*$ -user IN EXCLUDED_USERS| rename target_domain as domain
  

LP_Windows Group Created or Deleted¶

• Trigger Condition: Creation or deletion of a group.

• ATT&CK Category: Persistence, Defense Evasion

• ATT&CK Tag: Indicator Removal, Clear Persistence, Account Manipulation

• ATT&CK ID: T1070, T1070.009, T1098

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer label=Security label=Group label=Management -label=Member (label=Create or label=Remove) -user IN EXCLUDED_USERS
  

LP_Windows Group Policy Object Deletion¶

• Trigger Condition: Deletion of Group Policy Object.

• ATT&CK Category: Defense Evasion, Privilege Escalation

• ATT&CK Tag: Group Policy Modification, Domain Policy Modification

• ATT&CK ID: T1484.001, T1484

• Minimum Log Source Requirement: Windows

• Query:

  norm_id=WinServer label=Object label=Service label=Directory label=Delete class="groupPolicyContainer" -user IN EXCLUDED_USERS
  

LP_AD Privesc CVE-2022-26923 Exploitation¶

• Trigger Condition: Creation of a computer account spoofing a domain controller name, followed by successfully requesting a Machine certificate template from the CA server. This indicates exploitation of the privilege escalation vulnerability (CVE-2022-26923) in the Active Directory (AD) that was patched on May 10, 2022. For the alert to work, the WINDOWS_DC list must contain all the FQDNs of domain controllers operating in your domain.

• ATT&CK Category: Privilege Escalation

• ATT&CK Tag: Exploitation for Privilege Escalation

• ATT&CK ID: T1068

• Minimum Log Source Requirement: Windows

• Query:

  [norm_id=WinServer label=Computer label=Account label=Create dns_host IN WINDOWS_DC ] as s1 followed by [ norm_id=WinServer label=Certificate label=Request label=Approve attributes="CertificateTemplate:Machine" | norm on requester \<requester_account:'\S+'> ] as s2
  within 1 hour on s1.computer=s2.requester_account | rename s1.log_ts as account_creation_ts, s1.computer as computer, s1.user as user, s1.service as service, s1.dns_host as dns_host, s2.subject as certificate_subject | chart count() by account_creation_ts, computer, user, service, dns_host, certificate_subject
  

LP_AppLocker SmartlockerFilter detected file being written by process¶

• Trigger Condition: AppLocker’s SmartlockerFilter detects a file written by a process.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: Windows

• Query:

  norm_id="WinServer" event_source="Microsoft-Windows-AppLocker" label="Process" label=Change label=File
  

LP_Application Execution Attempt Blocked by AppLocker¶

• Trigger Condition: A user attempts to execute an application but is blocked by AppLocker.

• ATT&CK Category: -

• ATT&CK Tag: -

• ATT&CK ID: -

• Minimum Log Source Requirement: Windows

• Query:

  norm_id="WinServer" event_source="Microsoft-Windows-AppLocker" label=Application label=Block
  

LP_Curl Silent Mode Execution Detected¶

• Trigger Condition: When curl runs in silent mode. Client URL (curl) is a command line tool that transfers data to and from a server. Adversaries can use this technique to prevent showing file transfer progress and redirect output to a file.

• ATT&CK Category: Command and Control

• ATT&CK Tag: T1105 - Ingress Tool Transfer

• Minimum Log Source Requirement: Windows, Windows Sysmon

• Query:

  label="Process" label=Create command="*curl*" ((command="*-s*" command="*-o*") OR command="*-s*")
  

LP_Non-Existent User Login Attempt Detected¶

• Trigger Condition: When eight non-existent user login attempts on SSH service are detected in a minute. Secure Shell(ssh) is a protocol that provides a safe way to access a computer over a network. Adversaries can perform username brute force to find a valid username. Based on requirements and false positives, a user can modify the number of invalid login attempts and time frame.

• ATT&CK Category: Credential Access

• ATT&CK Tag: T1110 - Brute Force

• Minimum Log Source Requirement: Unix

• Query:

  [8 label=Invalid label=User "process"=sshd  having same source_address within 1 minutes]
  

LP_Malicious Image Loaded Via Excel¶

• Trigger Condition: When an unsigned image is loaded via Excel. XLL file is an add-in used by Microsoft Excel, a popular spreadsheet application. It contains extra functions, templates, or other tools that enhance the capabilities of Excel. Some examples of add-ins include custom chart generators and template managers. Adversaries can use this technique to load their malicious unsigned add-ins to execute their payload or download malware from a remote server.

• ATT&CK Category: Persistence

• ATT&CK Tag: T1137 - Office Application Startup, T1137.001 - Office Template Macros

• Minimum Log Source Requirement: Windows Sysmon

• Query:

  label=Image label=Load "process"="*\excel.exe" file IN ["*.xlam ","*.xla","*.xll"]  is_sign=false
  

LP_Execution of Temporary Files Via Office Application¶

• Trigger Condition: When Office applications create a child process that executes a file with the “.tmp” extension. Adversaries use this technique to avoid detection by using a legit application to run a payload masquerading as a temporary file.

• ATT&CK Category: Defense Evasion

• ATT&CK Tag: T1036 - Masquerading

• Minimum Log Source Requirement: Windows Sysmon, Windows

• Query:

  label="Process" label="Create" "parent_process" IN ["*\winword.exe", "*\powerpnt.exe", "*\excel.exe"] "process"="*.tmp"
  

LP_Binary Creation in System Folder Detected¶

• Trigger Condition: When the system process drops a binary or DLL in the Windows root folder. The operating system uses a system folder to store files necessary for proper function. A system folder is a primary location for DLL files. Adversaries may copy files between internal victim systems to support lateral movement using inherent file sharing protocols such as file sharing over SMB/Windows Admin Shares to connected network shares or authenticated connections via Remote Desktop Protocol.

• ATT&CK Category: Lateral Movement

• ATT&CK Tag: T1570 - Lateral Tool Transfer

• Minimum Log Source Requirement: Windows Sysmon

• Query:

  label=File label=Create label=Overwrite "process"=system path IN ["C:\windows\*"]  file IN ["*.exe", "*.dll"]
  

LP_High Volume of File Modification or Deletion in Short Span¶

• Trigger Condition: When LogPoint detects, 30 files are deleted or modified in a minute. A large number of file modifications and deletions is an indicator of ransomware in action. Based on the requirement and false positives detected, the user can modify the number of events required or the time frame. To generate logs, enable the auditing policy of desired folders. Many file modifications by a user/software can result in a false positive (FP), so to reduce it, exclude the process in the query.

• ATT&CK Category: Impact

• ATT&CK Tag: T1565 - Data Manipulation

• Minimum Log Source Requirement: Windows Sysmon, Windows

• Query:

[30 label=File label=Object label=Storage access IN ["Delete*","writedata*"] -"process" IN ["*\tiworker.exe","*\poqexec.exe","*\msiexec.exe"] having same host,domain,user,"process" within 1 minutes]

LP_Auditd High Volume of File Modification or Deletion in Short Span¶

• Trigger Condition: When 30 files are deleted or modified in a minute. A large number of file modifications and deletions is an indicator of ransomware in action. Based on the requirement and false positives detected, the user can modify the number of events required or the time frame. To generate logs, enable the auditing policy of desired folders. Many file modifications by a user/software can result in a false positive (FP), so to reduce it, exclude the process in the query. Logs from the auditd configured Linux system is required to trigger this alert.

• ATT&CK Category: Impact

• ATT&CK Tag: T1565 - Data Manipulation

• Minimum Log Source Requirement: Unix

• Query:

[30 label=File label=Info label=Path "process"=audit -name_type IN ["parent","normal"] having same event_type,user_id,host,"process" within 1 minutes]

LP_Windows RDP Port Modified¶

• Trigger Condition: When a remote desktop protocol (RDP) for Windows protocol is modified. RDP is a remote desktop protocol allowing users to have GUI access to a remote desktop. Adversaries can change the RDP port to evade the defense mechanism used to detect connections in the default RDP port.

• ATT&CK Category: Lateral Movement

• ATT&CK Tag: T1021.001 - Remote Desktop Protocol

• Minimum Log Source Requirement: Windows Sysmon

• Query:

label=Registry label=Value label=Set target_object="*\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\PortNumber"

LP_Possible Pass the Hash Activity Detected¶

• Trigger Condition: When a successful logon event (event ID 4624) occurs on a Windows Server under suspicious circumstances. Specifically, the logon involves either an anonymous caller using a network logon (type 3) with NTLM and no encryption, or a new credentials-based logon (type 9) using the “seclogo” process. This could indicate unauthorized or unusual access attempts, especially if the user is neither “ANONYMOUS LOGON” nor part of a predefined exclusion list. Adversaries may use such logon methods to establish persistence or perform lateral movement within the network while evading detection.

• ATT&CK Category: Defense Evasion, Lateral Movement

• ATT&CK Tag: T1550.002 - Pass the Hash, T1550 - Use Alternate Authentication Material

• Minimum Log Source Requirement: Windows Sysmon

• Query:

norm_id=WinServer event_id=4624 ((caller_id="S-1-0-0" logon_type="3" logon_process="NtLmSsp" key_length="0") OR (logon_type="9" logon_process="seclogo")) -user="ANONYMOUS LOGON" -user IN EXCLUDED_USERS

LP_Windows Block Inheritance on OU or Domain¶

• Trigger Condition: Inheritance is set to block on an OU or Domain.

• ATT&CK Category: Defense Evasion, Privilege Escalation

• ATT&CK Tag: Group Policy , Domain Policy Modification

• ATT&CK ID: T1484.001, T1484

• Minimum Log Source Requirement: Windows

• Query:

label=Change label=Service label=Directory (value=1 OR attribute_value=1) class IN ["domainDNS", "organizationalUnit"] -user IN EXCLUDED_USERS

LP_Windows Delegation of Authority Change on OU or Domain¶

• Trigger Condition: Delegation of Control wizard is used, or security settings are changed on OU or Domain.

• ATT&CK Category: Privilege Escalation, Defense Evasion

• ATT&CK Tag: Domain Policy Modification

• ATT&CK ID: T1484

• Minimum Log Source Requirement: Windows

• Query:

norm_id=WinServer label=Change label=Service label=Directory class IN ["organizationalUnit","domainDNS"] (ldap_display="nTSecurityDescriptor") -user IN EXCLUDED_USERS

LP_Windows GPO Linked or Unlinked to OU or Domain¶

• Trigger Condition: Group policy object linked or unlinked on an OU.

• ATT&CK Category: Defense Evasion, Privilege Escalation

• ATT&CK Tag: Group Policy Modification, Domain Policy Modification

• ATT&CK ID: T1484.001, T1484

• Minimum Log Source Requirement: Windows

• Query:

norm_id=WinServer* (label=Change or label=Remove) label=Object label=Directory ldap_display="gPLink" OR acl_change="gPLink" -user IN EXCLUDED_USERS | rename acl_change as ldap_display, type as operation_type

LP_Windows Security Service Terminated¶

• Trigger Condition: Windows security services got terminated successfully with an error.

• ATT&CK Category: Impact

• ATT&CK Tag: Service Stop

• ATT&CK ID: T1489

• Minimum Log Source Requirement: Windows

• Query:

norm_id=WinServer event_source="Service Control Manager" event_id="7023" (service IN WINDOWS_SECURITY_SERVICES OR binary_data IN WINDOWS_SECURITY_SERVICE_BINARIES)

LP_Windows User Account Created via Command Line¶

• Trigger Condition: Creation of a user account via CLI like PowerShell or via net utility is detected.

• ATT&CK Category: Execution, Persistence

• ATT&CK Tag: PowerShell, Create Account, Local Account

• ATT&CK ID: T1059.001, T1136, T1136.001

• Minimum Log Source Requirement: Windows

• Query:

label="process" label="create" (command="*New-LocalUser*" or command="*net user add*")

LP_Windows WMI Filter Linked or Unlinked with GPO¶

• Trigger Condition: WMI filter linked or unlinked with a group policy object.

• ATT&CK Category: Execution, Privilege Escalation, Defense Evasion

• ATT&CK Tag: Windows Management Instrumentation, Group Policy Modification, Domain Policy Modification

• ATT&CK ID: TT1047, T1484.001, T1484

• Minimum Log Source Requirement: Windows

• Query:

norm_id=WinServer label=Directory label=Object label=Service label=Change (acl_change="gPCWQLFilter" OR ldap_display="gPCWQLFilter") -user IN EXCLUDED_USERS | rename acl_change as ldap_display, type as operation_type