Possible Shadow Credentials Added — Sigma Rule

Rule metadata and linked tags

Author: Nasreddine Bencherchali (Nextron Systems), Elastic (idea). Source status: test; severity: high. Source dates: 2022-10-17 / not supplied.

{
  "product": "windows",
  "service": "security",
  "definition": "The \"Audit Directory Service Changes\" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule)"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 1dc09cb564205ec77c5567ecdd138aed417c9b7f99442d2c0de4677508a2a869

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Possible Shadow Credentials Added
id: f598ea0c-c25a-4f72-a219-50c44411c791
status: test
description: Detects possible addition of shadow credentials to an active directory object.
references:
    - https://www.elastic.co/guide/en/security/8.4/potential-shadow-credentials-added-to-ad-object.html
    - https://cyberstoph.org/posts/2022/03/detecting-shadow-credentials/
    - https://twitter.com/SBousseaden/status/1581300963650187264?
author: Nasreddine Bencherchali (Nextron Systems), Elastic (idea)
date: 2022-10-17
tags:
    - attack.persistence
    - attack.credential-access
    - attack.defense-impairment
    - attack.t1556
logsource:
    product: windows
    service: security
    definition: The "Audit Directory Service Changes" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule)
detection:
    selection:
        EventID: 5136
        AttributeLDAPDisplayName: 'msDS-KeyCredentialLink'
        # If you experience a lot of FP you could uncomment the selection below
        # There could be other cases for other tooling add them accordingly
        # AttributeValue|contains: 'B:828'
        # OperationType: '%%14674' # Value Added
    # As stated in the FP sections it's better to filter out the expected accounts that perform this operation to tighten the logic
    # Uncomment the filter below and add the account name (or any other specific field) accordingly
    # Don't forget to add it to the condition section below
    # filter:
        # SubjectUserName: "%name%"
    condition: selection
falsepositives:
    - Modifications in the msDS-KeyCredentialLink attribute can be done legitimately by the Azure AD Connect synchronization account or the ADFS service account. These accounts can be added as Exceptions. (From elastic FP section)
level: high

Original YAML and metadata in JSON

False positives

• Modifications in the msDS-KeyCredentialLink attribute can be done legitimately by the Azure AD Connect synchronization account or the ADFS service account. These accounts can be added as Exceptions. (From elastic FP section)

Source references

• https://www.elastic.co/guide/en/security/8.4/potential-shadow-credentials-added-to-ad-object.html
• https://cyberstoph.org/posts/2022/03/detecting-shadow-credentials/
• https://twitter.com/SBousseaden/status/1581300963650187264?