Active Directory Replication from Non Machine Account
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.
Severity
Critical
Rule Requirement
Criteria
Action1: actionname = "Operation Performed on Object" AND (ACCESSMASK = "0x100" AND PROPERTIES contains "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2,1131f6ad-9c07-11d1-f79f-00c04fc2dcd2,89e95b76-444d-4c62-991a-0facbeda640c") AND USERNAME notendswith "$,SOL_*" select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.DOMAIN,Action1.ACCESSES,Action1.OBJECTNAME,Action1.OBJECTTYPE
Detection
Execution Mode
realtime
Log Sources
Active Directory
Author
Roberto Rodriguez @Cyb3rWard0g
