Securityevent Securityserviceregistryaclmodification
KQL detection rule by ep3p · MIT
No description provided
let file_names = dynamic(["subinacl.exe", "SetACL.exe"]);
let registry_paths = dynamic([
@"Services\HealthService",
@"Services\Sense",
@"Services\WinDefend",
@"Services\MsSecFlt",
@"Services\DiagTrack",
@"Services\SgrmBroker",
@"Services\SgrmAgent",
@"Services\AATPSensorUpdater",
@"Services\AATPSensor",
@"Services\mpssvc"
]);
let parameters = dynamic([
@"/deny=SYSTEM",
@"/deny=S-1-5-18",
@"/grant=SYSTEM=r",
@"/grant=S-1-5-18=r",
@"n:SYSTEM;p:READ",
@"n1:SYSTEM;ta:remtrst;w:dacl"
]);
union
(
SecurityEvent
| where EventID == 4688
| where Process has_any (file_names) and CommandLine has_any (registry_paths) and CommandLine has_any (parameters)
| project
TimeGenerated,
Computer,
Account,
AccountType,
SubjectLogonId,
TargetAccount,
Activity,
NewProcessName,
CommandLine
),
(
SecurityEvent
| where EventID == 4670
| where ObjectType == "Key"
| mv-apply Auxiliar = parse_xml(EventData)["EventData"]["Data"] on (
summarize BagToUnpack = make_bag(bag_pack(tostring(Auxiliar["@Name"]), tostring(Auxiliar["#text"])))
)
| evaluate bag_unpack(BagToUnpack, columnsConflict="keep_source"): (TimeGenerated: datetime, Computer: string, Account: string, AccountType: string, SubjectLogonId: string, Activity: string, ProcessName: string, ObjectType: string, ObjectName: string, EventData: string, OldSd: string, NewSd: string)
// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/f4296d69-1c0f-491f-9587-a960b292d070?redirectedfrom=MSDN
| extend EntryType = substring(OldSd, 0, 1)
//| where EntryType == "D"
| extend
RemovedSd = iff(EntryType in ("O", "G"), split(OldSd, ":", 1), extract_all(@"\(([^\)]+)\)", OldSd)),
AddedSd = iff(EntryType in ("O", "G"), split(NewSd, ":", 1), extract_all(@"\(([^\)]+)\)", NewSd))
| extend
RemovedSd = iff(EntryType in ("O", "G"), RemovedSd, set_difference(RemovedSd, AddedSd)),
AddedSd = iff(EntryType in ("O", "G"), AddedSd, set_difference(AddedSd, RemovedSd))
| mv-expand RemovedSd to typeof(string)
| where RemovedSd endswith "SY"
| mv-expand AddedSd = iff(array_length(AddedSd) == 0, dynamic([""]), AddedSd) to typeof(string)
| where isempty(AddedSd) or AddedSd endswith "SY"
| where case(
isempty(AddedSd), true, // Local System access was removed
RemovedSd startswith "A" and AddedSd startswith "D", true, // Local System was denied
RemovedSd contains "KA" and not(AddedSd contains "KA"), true, // Local System Key All Access was removed
false
)
| project
TimeGenerated,
Computer,
Account,
AccountType,
SubjectLogonId,
Activity,
ProcessName,
ObjectType,
ObjectName,
EntryType,
OldSd,
NewSd,
RemovedSd,
AddedSd,
EventData
)