Vendor: Microsoft
June 14, 2023 · View on GitHub
Product: Windows
Use-Case: Account Manipulation
| Rules | Models | MITRE ATT&CK® TTPs | Event Types | Parsers |
|---|---|---|---|---|
| 97 | 47 | 16 | 9 | 9 |
| Event Type | Rules | Models |
|---|---|---|
| account-creation | T1098 - Account Manipulation ↳ AM-UA-MA-F-new: Account management activity for new user ↳ AM-GA-new: First account management activity for group of a new user T1136 - Create Account ↳ A-ACCT-CR-DEL: Account created and deleted on asset ↳ AC-UH-F: First account creation activity from asset for user ↳ AC-UH-A: Abnormal account creation activity from asset for user ↳ AC-OZ-F: First account creation activity from network zone ↳ AC-OZ-A: Abnormal account creation activity from network zone ↳ AC-OH-F: First account creation activity from asset in the organization ↳ AC-OH-A: Abnormal account creation activity from asset in the organization ↳ AC-UT-TOW-A: Abnormal day for user to perform account creation activity ↳ AM-UA-AC-F: First account creation activity for user ↳ AM-UA-AC-A: Abnormal account creation activity for user ↳ AM-GA-AC-F: First account creation activity for peer group ↳ AM-GA-AC-A: Abnormal account creation activity for peer group ↳ AM-UA-MA-F-new: Account management activity for new user ↳ AM-GA-new: First account management activity for group of a new user T1136.001 - Create Account: Create: Local Account ↳ A-AC-DhU-system-F: First account creation by system account on asset ↳ A-AC-DhU-system-A: Abnormal account creation by system account on asset ↳ AC-LocUA-F-new: First account creation activity by a new local user ↳ AC-LocUA-A: Abnormal account creation activity by local user T1136.002 - T1136.002 ↳ AM-UD-F: First account creation on domain for user ↳ AM-UD-A: Abnormal account creation on domain for user | • AE-GA: All activity for peer groups • AE-UA: All activity for users • AC-UT-TOW: Account creation activity time for user • AM-UD: Account creation on domain by user • AC-OH: Account creation hosts in organization • AC-OZ: Account creation activity from zone • AC-UH: Account creation activity on host for user • A-AC-DhU-system: System accounts performing account creation activities |
| account-deleted | T1531 - Account Access Removal ↳ AM-UA-AD-F: First account deletion activity for user T1136 - Create Account ↳ A-ACCT-CR-DEL: Account created and deleted on asset | • AE-UA: All activity for users |
| account-password-change | T1098 - Account Manipulation ↳ AM-UA-APLocU-F: First account password change for local user | |
| account-password-reset | T1098 - Account Manipulation ↳ AM-UA-APLocU-F: First account password change for local user | |
| ds-access | T1207 - Rogue Domain Controller ↳ A-DS-Replication: First time a new server replicated itself on this asset ↳ DS-DCSh-Add: Directory service server object added ↳ DS-DCSh-Del: Directory service server object created and deleted T1484 - Group Policy Modification ↳ DS-OU-F: First directory service event for user in the organization ↳ DS-OG-F: First directory service event for user in the peer group ↳ DS-OAT-F: First directory service activity type for object class ↳ DS-OAT-A: Abnormal directory service activity type for object class ↳ DS-UAT-F: First directory service activity type for user per object class ↳ DS-UAT-A: Abnormal directory service activity type for user per object class ↳ DS-OOC-F: First directory service object class for organization ↳ DS-OOC-A: Abnormal directory service object class for organization ↳ DS-GOC-F: First directory service object class for peer group ↳ DS-GOC-A: Abnormal directory service object class for peer group ↳ DS-UOC-F: First directory service object class for user ↳ DS-UOC-A: Abnormal directory service object class for user ↳ DS-APRIV: Non-Privileged user accessing privileged directory service attribute ↳ DS-UA: First access to attribute for privileged user ↳ DS-OH-F: First directory service activity on host for organization ↳ DS-OH-A: Abnormal directory service activity on host for organization ↳ DS-GH-F: First directory service activity on host for peer group ↳ DS-GH-A: Abnormal directory service activity on host for peer group ↳ DS-UH-F: First directory service activity on host for user ↳ DS-UH-A: Abnormal directory service activity on host for user ↳ DS-OSZ-F: First directory service activity from source zone for organization ↳ DS-OSZ-A: Abnormal directory service activity from source zone for organization ↳ DS-GSZ-F: First directory service activity from source zone for peer group ↳ DS-GSZ-A: Abnormal directory service activity from source zone for peer group ↳ DS-USZ-F: First directory service activity from source zone for user ↳ DS-USZ-A: Abnormal directory service activity from source zone for user ↳ DS-USH-F: First directory service activity on source host for user ↳ DS-USH-A: Abnormal directory service activity on source host for user | • DS-USH: Source hosts with directory service activity for user • DS-USZ: Source network zones with directory service activity for the user • DS-GSZ: Source network zones with directory service activity in the peer group • DS-OSZ: Source network zones with directory service activity in the organization • DS-UH: Hosts with directory service activity in the user • DS-GH: Hosts with directory service activity in the peer group • DS-OH: Hosts with directory service activity in the organization • DS-UA: Attributes per privileged user • DS-APRIV: Privileged user attributes • DS-UOC: Directory service object classes for user • DS-GOC: Directory service object classes in the peer group • DS-OOC: Directory service object classes in the organization • DS-UAT-new: Directory services activity types for user per object class • DS-OAT-new: Directory services activity types per object class • DS-OG: Users with directory service activity in the peer group • DS-OU: Users with directory service activity in the organization |
| member-added | T1098 - Account Manipulation ↳ A-GM-DhU-system-F: First group management by system account on asset ↳ GM-LocUA-F-new: First group management activity by a new local user ↳ GM-LocUA-A: Abnormal group management activity by local user ↳ MA-SELF: User added themself to a group ↳ MA-PRIV-F-local: First addition to privileged group by local user ↳ MA-PRIV-A: Abnormal addition to privileged group by user ↳ GM-UH-F: First group management activity from asset for user ↳ GM-UH-A: Abnormal group management activity from asset for user ↳ GM-OZ-F: First group management activity from network zone ↳ GM-OZ-A: Abnormal group management activity from network zone ↳ GM-OH-F: First group management activity from asset in the organization ↳ GM-OH-A: Abnormal group management activity from asset in the organization ↳ GM-UT-TOW-A: Abnormal day for user to perform group management activity ↳ AM-GA-MA-F: First account group management activity for peer group ↳ AM-OU-SS-F: First addition and removal of member from a group by user in a single session for organization ↳ AM-OU-SS-A: Abnormal addition and removal of member from a group in a single session in the organization ↳ AM-OG-SS-F: First addition and removal of member from a group by user in a single session for peer group ↳ AM-OG-SS-A: Abnormal addition and removal of member from a group in a single session in the peer group ↳ AM-OG-F: First member addition to this group for the organization ↳ AM-OG-A: Abnormal account addition to this group for the organization ↳ AM-GOU-F: First account OU addition to this group ↳ AM-GOU-A: Abnormal account OU addition to this group ↳ AM-UA-MA-F-new: Account management activity for new user ↳ AM-GA-new: First account management activity for group of a new user T1136 - Create Account ↳ AM-UA-MA-F-new: Account management activity for new user ↳ AM-GA-new: First account management activity for group of a new user | • AE-GA: All activity for peer groups • AM-GOU: Account management, OUs that are added to security groups • AM-AG: Account management, groups which users are being added to • AM-OG-SS: Models the peer groups who perform addition and removal of members from group in same session • AM-OU-SS: Models the users who perform addition and removal of members from group in same session in the organization • AE-UA: All activity for users • GM-UT-TOW: Group management activity time for user • GM-OH: Group management hosts in organization • GM-OZ: Group management activity from zone • GM-UH: Group management activity on host for user • AM-OU-PG: Account group management of high privileges in the organization • A-GM-DhU-system: System accounts performing group management activities |
| member-removed | T1098 - Account Manipulation ↳ GM-LocUA-F-new: First group management activity by a new local user ↳ GM-LocUA-A: Abnormal group management activity by local user ↳ GM-UH-F: First group management activity from asset for user ↳ GM-UH-A: Abnormal group management activity from asset for user ↳ GM-OZ-F: First group management activity from network zone ↳ GM-OZ-A: Abnormal group management activity from network zone ↳ GM-OH-F: First group management activity from asset in the organization ↳ GM-OH-A: Abnormal group management activity from asset in the organization ↳ GM-UT-TOW-A: Abnormal day for user to perform group management activity ↳ AM-UA-MA-F: First account group management activity for user ↳ AM-GA-MA-F: First account group management activity for peer group ↳ AM-OU-SS-F: First addition and removal of member from a group by user in a single session for organization ↳ AM-OU-SS-A: Abnormal addition and removal of member from a group in a single session in the organization ↳ AM-OG-SS-F: First addition and removal of member from a group by user in a single session for peer group ↳ AM-OG-SS-A: Abnormal addition and removal of member from a group in a single session in the peer group | • AM-OG-SS: Models the peer groups who perform addition and removal of members from group in same session • AM-OU-SS: Models the users who perform addition and removal of members from group in same session in the organization • AE-GA: All activity for peer groups • AE-UA: All activity for users • GM-UT-TOW: Group management activity time for user • GM-OH: Group management hosts in organization • GM-OZ: Group management activity from zone • GM-UH: Group management activity on host for user |
| process-created | T1531 - Account Access Removal ↳ NET-EXE-DELETE-ORG-F: First time net.exe has been used to delete a user account by this user. ↳ NET-EXE-DELETE-ORG-A: Abnormal usage of net.exe to delete a user account by this user. T1078 - Valid Accounts ↳ NET-EXE-ADD-GRP-ORG-F: First time net.exe has been used to create/add to a group by this user. ↳ NET-EXE-ADD-GRP-ORG-A: Abnormal usage of net.exe to create/add to a group by this user. ↳ NET-EXE-ACTIVE-ORG-F: First time net.exe has been used to disable/enable a user account by this user. ↳ NET-EXE-ACTIVE-ORG-A: Abnormal usage of net.exe to disable/enable a user account by this user. T1098 - Account Manipulation ↳ NET-EXE-ADD-GRP-ORG-F: First time net.exe has been used to create/add to a group by this user. ↳ NET-EXE-ADD-GRP-ORG-A: Abnormal usage of net.exe to create/add to a group by this user. ↳ NET-EXE-ACTIVE-ORG-F: First time net.exe has been used to disable/enable a user account by this user. ↳ NET-EXE-ACTIVE-ORG-A: Abnormal usage of net.exe to disable/enable a user account by this user. T1136 - Create Account ↳ NET-EXE-ADD-GRP-ORG-F: First time net.exe has been used to create/add to a group by this user. ↳ NET-EXE-ADD-GRP-ORG-A: Abnormal usage of net.exe to create/add to a group by this user. T1136.001 - Create Account: Create: Local Account ↳ AC-OZ-CLI-F: First zone on which account was created using CLI command ↳ AC-OH-CLI-F: First host on which account was created using CLI command ↳ NET-EXE-ADD-ORG-F: First time net.exe has been used to create a user account by this user. ↳ NET-EXE-ADD-ORG-A: Abnormal usage of net.exe to create a user account by this user. T1021.003 - T1021.003 ↳ A-MMC-Spawn-Win-Shell: MMC (Microsoft Management Console) started a Windows command line executable on this asset. ↳ MMC-Spawn-Win-Shell: MMC (Microsoft Management Console) started a Windows command line executable. T1059.001 - Command and Scripting Interperter: PowerShell ↳ A-MMC-Spawn-Win-Shell: MMC (Microsoft Management Console) started a Windows command line executable on this asset. ↳ MMC-Spawn-Win-Shell: MMC (Microsoft Management Console) started a Windows command line executable. T1059.003 - T1059.003 ↳ A-MMC-Spawn-Win-Shell: MMC (Microsoft Management Console) started a Windows command line executable on this asset. ↳ MMC-Spawn-Win-Shell: MMC (Microsoft Management Console) started a Windows command line executable. T1218.010 - Signed Binary Proxy Execution: Regsvr32 ↳ A-MMC-Spawn-Win-Shell: MMC (Microsoft Management Console) started a Windows command line executable on this asset. ↳ MMC-Spawn-Win-Shell: MMC (Microsoft Management Console) started a Windows command line executable. T1559.002 - T1559.002 ↳ A-MMC-Spawn-Win-Shell: MMC (Microsoft Management Console) started a Windows command line executable on this asset. ↳ MMC-Spawn-Win-Shell: MMC (Microsoft Management Console) started a Windows command line executable. T1003 - OS Credential Dumping ↳ A-ShadowCP-SymLink: Shadow Copies Access via Symlink on this asset ↳ ShadowCP-SymLink: Shadow Copies Access via Symlink T1003.003 - T1003.003 ↳ A-AD-Diagnostic-Tool: Invocation of Active Directory Diagnostic Tool (ntdsutil.exe) on this asset | • NET-EXE-DELETE-ORG: Using net.exe to delete a user account • NET-EXE-ACTIVE-ORG: Using net.exe to disable/enable a user account • NET-EXE-ADD-GRP-ORG: Using net.exe to add a group account • NET-EXE-ADD-ORG: Using net.exe to add a user account • AC-OH-CLI: Hosts on which account was created using CLI command • AC-OZ-CLI: Zones on which account was created using CLI command |
| vpn-logout | T1098.002 - Account Manipulation: Exchange Email Delegate Permissions ↳ EM-InB-Perm-A: Abnormal number of mailbox permission given by user. T1484 - Group Policy Modification ↳ FDS-Count: Abnormal number of failed directory service events in the organization ↳ FDS-GCount: Abnormal number of failed directory service events in the peer group ↳ FDS-UCount: Abnormal number of failed directory service events in the user ↳ DS-Count: Abnormal number of directory service events in the organization ↳ DS-GCount: Abnormal number of directory service events in the peer group ↳ DS-UCount: Abnormal number of directory service events in the user | • EM-InB-Perm: Models the number of mailbox permissions given by this user. • DS-UCount: Count of directory service activity events in the user • DS-GCount: Count of directory service activity events in the peer group • DS-Count: Count of directory service activity events in the organization • FDS-UCount: Count of failed directory service activity events in the user • FDS-GCount: Count of failed directory service activity events in the peer group • FDS-Count: Count of failed directory service activity events in the organization |