Active Directory Investigation

id: Active Directory Investigation
version: -1
name: Active Directory Investigation
description: |-
  Active Directory Investigation playbook provides tools and guidance to investigate changes and manipulation in Active Directory containers, ACLs, Schema, and objects.
  This playbook uses a 3rd party tool provided by Microsoft to scan the Active Directory access list, trees, and objects.
  Additional investigative information is provided for manual investigation.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 1e402223-77fd-4729-898d-51d541d65526
    type: start
    task:
      id: 1e402223-77fd-4729-898d-51d541d65526
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": -110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: ea482bb2-97ea-417d-815b-3d4cff43e48a
    type: regular
    task:
      id: ea482bb2-97ea-417d-815b-3d4cff43e48a
      version: -1
      name: Review the Active Directory AdminSDHolder permissions
      description: "Review the AdminSDHolder permissions to make sure there are no unwanted users/groups. - \n\n1. AdminSDHolder is a container that exists in every Active Directory domain for a particular purpose. \nThe Access Control List (ACL) of the AdminSDHolder object is used as a template to copy permissions to all “protected groups” in Active Directory and their members. \nProtected groups include privileged groups such as Domain Admins, Administrators, Enterprise Admins, and Schema Admins. \nThis includes other groups that give login rights to domain controllers, which can be enough access to perpetrate attacks and to compromise the domain.\n\n\n2. Active Directory will take the ACL of the AdminSDHolder object and apply it to all protected users and groups periodically to make sure the access to these objects is secure. This works, in theory, because the default ACL for AdminSDHolder is very restrictive. \nHowever, if an attacker can manipulate the ACL for AdminSDHolder, those permissions will automatically be applied to all protected objects. \nThis will give an attacker a way to create persistent access to privileged accounts within the domain.\n\n\n3. The AdminSDHolder permissions are pushed down to all protected objects by the SDProp process. By default, this happens every 60 minutes, but this interval can be changed by modifying a registry key value. \nThis means that if an administrator sees an inappropriate permission on a protected object and removes it, within an hour, those permissions will be restored by SDProp.\n\n\n4. More information about AdminSDHolder: -\nhttps://docs.microsoft.com/en-us/previous-versions/technet-magazine/ee361593(v=msdn.10)?redirectedfrom=MSDN#id0250006\n\n\n5. Review the permissions for the AdminSDHolder container for unwanted users/groups by selecting the container > Properties > Security > Advanced.\n"
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 20
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: 63dc8892-db0a-46d4-8dc6-1517a4033576
    type: regular
    task:
      id: 63dc8892-db0a-46d4-8dc6-1517a4033576
      version: -1
      name: Run the Active Directory ACL Scanner
      description: "Identify compromised accounts. \nAttackers will aim for a high privileged domain account that will enable them to spread and deliver the malicious payload to as many endpoints/servers as possible. \n\nTo simplify the work of creating and documenting the delegation model in Active Directory, a tool with a GUI in PowerShell is provided below.\nThis tool creates reports of the access control list for all of your Active Directory objects. With these reports, you can see what/where, and when permissions have been set.\n\nTo run the script, the minimum requirements are: PowerShell 2.0 and Windows 7/Windows Server 2008 (Windows Server 2003 can be used, but it will have limited functionality).\n\nEnable unsigned scripting in PowerShell by using the command:\nSet-ExecutionPolicy Unrestricted.\n\nIf you are not a local admin and cannot set it on your machine, you can set it for your profile:\nSet-ExecutionPolicy Unrestricted - Scope CurrentUser.\nYou do not need Powershell Module for Active Directory.\n\nMicrosoft article about Active Directory forensics with ACL Scanner:\nhttps://docs.microsoft.com/en-us/archive/blogs/pfesweplat/forensics-active-directory-acl-investigation\n\nMicrosoft article about AD ACL scanner tool:\nhttps://docs.microsoft.com/en-us/archive/blogs/pfesweplat/take-control-over-ad-permissions-and-the-ad-acl-scanner-tool\n\nAD ACL Scanner Github project:\nhttps://github.com/canix1/ADACLScanner\n"
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 5dbb4398-13fb-4ccd-89af-a0e21515ea39
    type: collection
    task:
      id: 5dbb4398-13fb-4ccd-89af-a0e21515ea39
      version: -1
      name: Review the Active Directory ACL Scanner report
      description: "Sends an email to the configured users requesting they review the report and supply a list of the compromised users. Supports CSV format.\n "
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: List compromised users
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: "List the compromised users. \nCan be in CSV Format."
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: List compromised users
      description: ""
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: 6183f496-bd4a-46e8-898f-2f2cdfcd901b
    type: condition
    task:
      id: 6183f496-bd4a-46e8-898f-2f2cdfcd901b
      version: -1
      name: Was a compromised account detected?
      description: ''''''
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: List compromised users.Answers
                accessor: "0"
            iscontext: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": 580
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: c6fbeaa0-7dc1-4fc0-82dd-03ca65a1a096
    type: regular
    task:
      id: c6fbeaa0-7dc1-4fc0-82dd-03ca65a1a096
      version: -1
      name: Review the Active Directory event log
      description: "Partial list of domain controller events to pay attention to: \nNote: If ACL Scanner returned positive results, search for more events around the time and date of the results.\n\n4794 DSRM account password change attempt - If this isn’t expected, could be malicious.\n4780 ACLs set on admin accounts - If this isn’t expected, could be malicious.\n4739/643 Domain Policy was changed - If this isn’t expected, could be malicious.\n4713/617 Kerberos policy was changed - If this isn’t expected, could be malicious.\n4724/628 Attempt to reset an account’s password - Monitor for admin & sensitive account PW reset.\n4735/639 Security-enabled local group changed- Monitor admin/sensitive group membership changes.\n4737/641 Security-enabled global group changed -Monitor admin/sensitive group membership changes.\n4755/659 Security-enabled universal group changed - Monitor admin & sensitive group membership."
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: 7b689888-a6bf-4e18-8a52-9ee621221e31
    type: regular
    task:
      id: 7b689888-a6bf-4e18-8a52-9ee621221e31
      version: -1
      name: Remediate according to the Active Directory event log findings
      description: "Remediate the issues identified in the Active Directory event log review."
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: 385f5cda-bfd6-4a47-8ff3-b3feb3b0d68c
    type: title
    task:
      id: 385f5cda-bfd6-4a47-8ff3-b3feb3b0d68c
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1490
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: 6a4bdd2c-2da3-4e74-8a16-c19246c2ac38
    type: regular
    task:
      id: 6a4bdd2c-2da3-4e74-8a16-c19246c2ac38
      version: -1
      name: Disable compromised account in Active Directory
      description: Disable an Active Directory user account.
      script: '|||ad-disable-account'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      base-dn: {}
      username:
        complex:
          root: incident
          accessor: usernames
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 990
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: cbc24d77-b993-4c15-8b14-8f9ba64d90b9
    type: regular
    task:
      id: cbc24d77-b993-4c15-8b14-8f9ba64d90b9
      version: -1
      name: 'Set Compromised users'
      description: Change the properties of an incident.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      accountid: {}
      accountname: {}
      addLabels: {}
      agentid: {}
      alertid: {}
      alertname: {}
      app: {}
      appendMultiSelect: {}
      assetid: {}
      assigneduser: {}
      assignmentgroup: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      blockedaction: {}
      bugtraq: {}
      caller: {}
      categorycount: {}
      city: {}
      closeNotes: {}
      closeReason: {}
      closetime: {}
      closingreason: {}
      closinguser: {}
      cloudservice: {}
      commandline: {}
      compliancenotes: {}
      costcenter: {}
      costcentercode: {}
      country: {}
      countryname: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cvssavailabilityrequirement: {}
      cvsscollateraldamagepotential: {}
      cvssconfidentialityrequirement: {}
      cvssintegrityrequirement: {}
      dbotMirrorDirection: {}
      dbotMirrorId: {}
      dbotMirrorInstance: {}
      dbotMirrorTags: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      department: {}
      dest: {}
      desthostname: {}
      destinationgeolocation: {}
      destinationhostname: {}
      destinationip: {}
      destinationips: {}
      destinationipv6: {}
      destinationmacaddress: {}
      destinationnetwork: {}
      destinationport: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectedexternalhosts: {}
      detectedexternalips: {}
      detectedinternalhosts: {}
      detectedinternalips: {}
      detectedusers: {}
      detectionendtime: {}
      detectionid: {}
      detectionupdatetime: {}
      detectionurl: {}
      deviceexternalip: {}
      devicehash: {}
      devicelocalip: {}
      devicemodel: {}
      devicename: {}
      devicetime: {}
      displayname: {}
      dnsname: {}
      dstports: {}
      duration: {}
      email: {}
      emailauthenticitycheck: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      escalation: {}
      eventaction: {}
      eventdescriptions: {}
      eventid: {}
      eventnames: {}
      events: {}
      eventtype: {}
      externaladdresses: {}
      filehash: {}
      filename: {}
      filepath: {}
      filesize: {}
      firstname: {}
      firstseen: {}
      followup: {}
      givenname: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      highlevelcategories: {}
      hostname: {}
      hosts: {}
      id: {}
      incomingmirrorerror: {}
      infectedhosts: {}
      internaladdresses: {}
      investigationstage: {}
      isolated: {}
      jobcode: {}
      jobfamily: {}
      jobfunction: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastname: {}
      lastseen: {}
      lastupdatetime: {}
      leadership: {}
      listofrulesevent: {}
      location: {}
      locationregion: {}
      logsource: {}
      logsourcename: {}
      logsourcetype: {}
      lowlevelcategoriesevents: {}
      macaddress: {}
      maliciousbehavior: {}
      malwarefamily: {}
      malwarename: {}
      manageremailaddress: {}
      managername: {}
      md5: {}
      mobiledevicemodel: {}
      mobilephone: {}
      name: {}
      numberoflogsources: {}
      occurred: {}
      os: {}
      osversion: {}
      outgoingmirrorerror: {}
      owner: {}
      parentprocessid: {}
      personalemail: {}
      phase: {}
      phishingsubtype: {}
      phonenumber: {}
      pid: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      postnatdestinationip: {}
      postnatdestinationport: {}
      postnatsourceip: {}
      postnatsourceport: {}
      prenatdestinationport: {}
      prenatsourceip: {}
      prenatsourceport: {}
      protocol: {}
      protocolevent: {}
      protocols: {}
      quarantined: {}
      ransomwareapproximatenumberofencryptedendpoints: {}
      ransomwarecryptocurrencyaddress: {}
      ransomwarecryptocurrencyaddresstype: {}
      ransomwaredataencryptionstatus: {}
      ransomwareemail: {}
      ransomwareencryptedfileowner: {}
      ransomwarenote: {}
      ransomwareonionaddress: {}
      ransomwareonionurl: {}
      ransomwarerecoverytool: {}
      ransomwarestrain: {}
      rating: {}
      rawevent: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      samaccountname: {}
      severity: {}
      sha256: {}
      signature: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcegeolocation: {}
      sourcehostname: {}
      sourceip: {}
      sourceips: {}
      sourceipv6: {}
      sourcemacaddress: {}
      sourcenetwork: {}
      sourceport: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcports: {}
      srcuser: {}
      starttime: {}
      state: {}
      streetaddress: {}
      subcategory: {}
      subtype: {}
      surname: {}
      systems: {}
      technicalowner: {}
      technicalownercontact: {}
      technicaluser: {}
      tenantname: {}
      terminatedaction: {}
      threatactor: {}
      ticketcloseddate: {}
      ticketnumber: {}
      ticketopeneddate: {}
      title: {}
      trafficdirection: {}
      triggeredsecurityprofile: {}
      type: {}
      uniqueports: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      username: {}
      usernames:
        complex:
          root: List compromised users.Answers
          accessor: "0"
      users: {}
      vendorid: {}
      vendorproduct: {}
      vulnerabilitycategory: {}
      workphone: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrstatusv2: {}
      xdrurl: {}
      xdrusercount: {}
      zipcode: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 830
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "4_6_#default#": 0.16
    },
    "paper": {
      "dimensions": {
        "height": 1665,
        "width": 380,
        "x": 450,
        "y": -110
      }
    }
  }
inputs: []
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.0.0
supportedModules:
- agentix
- xsiam