{"id":"300bac00-e041-4ee2-9c36-e262656a6ecc","title":"Active Directory User Backdoors","description":"Detects scenarios where one can control another users or computers account without having to use their credentials.","author":"@neu5ron","status":"test","level":"high","date":"2017-04-13","modified":"2024-02-26","tags":["attack.privilege-escalation","attack.t1098","attack.persistence"],"technique_ids":["T1098"],"logsource":{"product":"windows","service":"security","definition":"Requirements: Audit Policy : Account Management > Audit User Account Management, Group Policy : Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Account Management\\Audit User Account Management, DS Access > Audit Directory Service Changes, Group Policy : Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\DS Access\\Audit Directory Service Changes"},"falsepositives":["Unknown"],"references":["https://msdn.microsoft.com/en-us/library/cc220234.aspx","https://adsecurity.org/?p=3466","https://blog.harmj0y.net/redteaming/another-word-on-delegation/"],"source_path":"rules/windows/builtin/security/win_security_alert_ad_user_backdoors.yml","source_sha256":"bf23cf7fd55b43733729da123ce24214324cad4a993d80051de8bd0bbe193629","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_alert_ad_user_backdoors.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Active Directory User Backdoors\nid: 300bac00-e041-4ee2-9c36-e262656a6ecc\nstatus: test\ndescription: Detects scenarios where one can control another users or computers account without having to use their credentials.\nreferences:\n    - https://msdn.microsoft.com/en-us/library/cc220234.aspx\n    - https://adsecurity.org/?p=3466\n    - https://blog.harmj0y.net/redteaming/another-word-on-delegation/\nauthor: '@neu5ron'\ndate: 2017-04-13\nmodified: 2024-02-26\ntags:\n    - attack.privilege-escalation\n    - attack.t1098\n    - attack.persistence\nlogsource:\n    product: windows\n    service: security\n    definition: 'Requirements: Audit Policy : Account Management > Audit User Account Management, Group Policy : Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Account Management\\Audit User Account Management, DS Access > Audit Directory Service Changes, Group Policy : Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\DS Access\\Audit Directory Service Changes'\ndetection:\n    selection1:\n        EventID: 4738\n    filter_empty:\n        AllowedToDelegateTo:\n            - ''\n            - '-'\n    filter_null:\n        AllowedToDelegateTo: null\n    selection_5136_1:\n        EventID: 5136\n        AttributeLDAPDisplayName: 'msDS-AllowedToDelegateTo'\n    selection_5136_2:\n        EventID: 5136\n        ObjectClass: 'user'\n        AttributeLDAPDisplayName: 'servicePrincipalName'\n    selection_5136_3:\n        EventID: 5136\n        AttributeLDAPDisplayName: 'msDS-AllowedToActOnBehalfOfOtherIdentity'\n    condition: (selection1 and not 1 of filter_*) or 1 of selection_5136_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1098","id":"T1098","name":"Account Manipulation","page":"techniques/enterprise/T1098/"}],"data_path":"data/detection-rules/300bac00-e041-4ee2-9c36-e262656a6ecc.json","kind":"sigma"}