Active Directory User Backdoors
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects scenarios where one can control another users or computers account without having to use their credentials.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Object Changed or Network Share Accessed" AND ((ALLOWEDTODELEGATETO != ",-" AND isExist(ALLOWEDTODELEGATETO))) OR (DISPLAYNAME = "msDS-AllowedToDelegateTo" OR (OBJECTTYPE = "user" AND DISPLAYNAME = "servicePrincipalName") OR DISPLAYNAME = "msDS-AllowedToActOnBehalfOfOtherIdentity") select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.DOMAIN,Action1.TARGETDOMAIN,Action1.TARGETMACHINE,Action1.RELATIVETARGETNAME,Action1.SHARENAME,Action1.SHAREPATH,Action1.OBJECTTYPE,Action1.OBJECTNAME,Action1.CHANGES
Detection
Execution Mode
realtime
Log Sources
Active Directory
Author
@neu5ron
