<jupyter_start><jupyter_text>Active Directory Replication User Backdoor  Metadata |     Metadata      |  Value  ||:------------------|:---|| collaborators     | ['@Cyb3rWard0g', '@Cyb3rPandaH'] || creation date     | 2019/01/01 || modification date | 2020/09/20 || playbook related  | ['WIN-180815210510'] |  HypothesisAdversaries with enough permissions (domain admin) might be adding an ACL to the Root Domain for any user to abuse active directory replication services.  Technical ContextActive Directory replication is the process by which the changes that originate on one domain controller are automatically transferred to other domain controllers that store the same data.Active Directory data takes the form of objects that have properties, or attributes.Each object is an instance of an object class, and object classes and their respective attributes are defined in the Active Directory schema. The values of the attributes define the object, and a change to a value of an attribute must be transferred from the domain controller on which it occurs to every other domain controller that stores a replica of that object.  Offensive TradecraftAn adversary with enough permissions (domain admin) can add an ACL to the Root Domain for any user, despite being in no privileged groups, having no malicious sidHistory, and not having local admin rights on the domain controller. This is done to bypass detection rules looking for Domain Admins or the DC machine accounts performing active directory replication requests against a domain controller.The following access rights / permissions are needed for the replication request according to the domain functional level| Control access right symbol | Identifying GUID used in ACE || :-----------------------------| :------------------------------|| DS-Replication-Get-Changes | 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 || DS-Replication-Get-Changes-All | 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 || DS-Replication-Get-Changes-In-Filtered-Set | 89e95b76-444d-4c62-991a-0facbeda640c |Additional reading* https://github.com/OTRF/ThreatHunter-Playbook/tree/master/docs/library/active_directory_replication.md  Security Datasets | Metadata  |    Value  ||:----------|:----------|| docs      | https://securitydatasets.com/notebooks/atomic/windows/defense_evasion/SDWIN-190301125905.html        || link      | [https://raw.githubusercontent.com/OTRF/Security-Datasets/master/datasets/atomic/windows/defense_evasion/host/empire_powerview_ldap_ntsecuritydescriptor.zip](https://raw.githubusercontent.com/OTRF/Security-Datasets/master/datasets/atomic/windows/defense_evasion/host/empire_powerview_ldap_ntsecuritydescriptor.zip)  |  Analytics  Initialize Analytics Engine<jupyter_code>from openhunt.mordorutils import *
spark = get_spark()<jupyter_output><empty_output><jupyter_text>Download & Process Security Dataset<jupyter_code>sd_file = "https://raw.githubusercontent.com/OTRF/Security-Datasets/master/datasets/atomic/windows/defense_evasion/host/empire_powerview_ldap_ntsecuritydescriptor.zip"
registerMordorSQLTable(spark, sd_file, "sdTable")<jupyter_output><empty_output><jupyter_text>Analytic ILook for any user accessing directory service objects with replication permissions GUIDs | Data source | Event Provider | Relationship | Event ||:------------|:---------------|--------------|-------|| Windows active directory | Microsoft-Windows-Security-Auditing | User accessed AD Object | 4662 |<jupyter_code>df = spark.sql(
'''
SELECT `@timestamp`, Hostname, SubjectUserName, ObjectName, OperationType
FROM sdTable
WHERE LOWER(Channel) = "security"
    AND EventID = 4662
    AND ObjectServer = "DS"
    AND AccessMask = "0x40000"
    AND ObjectType LIKE "%19195a5b_6da0_11d0_afd3_00c04fd930c9%"
'''
)
df.show(10,False)<jupyter_output><empty_output><jupyter_text>Analytic IILook for any user modifying directory service objects with replication permissions GUIDs | Data source | Event Provider | Relationship | Event ||:------------|:---------------|--------------|-------|| Windows active directory | Microsoft-Windows-Security-Auditing | User modified AD Object | 5136 |<jupyter_code>df = spark.sql(
'''
SELECT `@timestamp`, Hostname, SubjectUserName, ObjectDN, AttributeLDAPDisplayName
FROM sdTable
WHERE LOWER(Channel) = "security"
    AND EventID = 5136
    AND lower(AttributeLDAPDisplayName) = "ntsecuritydescriptor"
    AND (AttributeValue LIKE "%1131f6aa_9c07_11d1_f79f_00c04fc2dcd2%"
        OR AttributeValue LIKE "%1131f6ad_9c07_11d1_f79f_00c04fc2dcd2%"
        OR AttributeValue LIKE "%89e95b76_444d_4c62_991a_0facbeda640c%")
'''
)
df.show(10,False)<jupyter_output><empty_output>
{'fraction_non_alphanumeric': 0.12019853258523953, 'fraction_numerical': 0.04380664652567976, 'mean_word_length': 4.452941176470588, 'pattern_counts': {'":': 0, '<': 17, '<?xml version=': 0, '>': 17, 'https://': 5, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 1, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'chain_length': '4', 'dir': 'jupyter-structured-clean-dedup', 'id': '527142', 'license': 'MIT', 'n_tokens_mistral': 1448, 'n_tokens_neox': 1285, 'n_words': 381, 'path': 'docs/notebooks/windows/05_defense_evasion/WIN-190101151110.ipynb', 'repo_name': 'hitenkoku/ThreatHunter-Playbook', 'size': '4634'}