启用msDS-KeyCredentialLink变更审计
技术背景
标准审计配置不会记录对msDS-KeyCredentialLink属性的更改。这种审计缺失给安全调查带来重大挑战。通过TrustedSec的研究成果和OTRF（Open Threat Research Forge）开发的开源工具，我们现在能够有效监控这一关键属性的变更。
配置审计规则
获取属性GUID
msDS-KeyCredentialLink属性的Schema GUID为：5b47d60f-6090-40b2-9f37-2a4de88f3063
PowerShell配置命令
1
2
3
4
|
Import-Module ActiveDirectory
iwr -Uri https://raw.githubusercontent.com/OTRF/Set-AuditRule/master/Set-AuditRule.ps1 -OutFile Set-AuditRule.ps1
Import-Module .\Set-AuditRule.ps1
Set-AuditRule -AdObjectPath 'AD:\DC=doazlab,DC=com' -WellKnownSidType WorldSid -Rights WriteProperty,GenericWrite -InheritanceFlags All -AttributeGUID 5b47d60f-6090-40b2-9f37-2a4de88f3063 -AuditFlags Success
|
Microsoft Sentinel检测逻辑
KQL查询语句
1
2
3
4
5
6
|
union Event, SecurityEvent
| where EventID == 5136
| parse EventData with * 'ObjectDN">' ObjectDN "<" *
| parse EventData with * 'AttributeLDAPDisplayName">' ModifiedAttribute "<" *
| where ModifiedAttribute == "msDS-KeyCredentialLink"
| project Computer , TimeGenerated , Activity, ObjectDN, ModifiedAttribute
|
实施效果
配置审计规则后，当域控制器启用目录服务审计时，对对象msDS-KeyCredentialLink属性的所有更改都将生成审计事件日志。
资源链接
- TrustedSec研究文档：https://trustedsec.com/blog/a-hitch-hackers-guide-to-dacl-based-detections-part-1b
- Set-AuditRule工具：https://github.com/OTRF/Set-AuditRule
- 完整检测方案：https://github.com/DefensiveOrigins/Detect-msDS-KeyCredentialLink