Thanks to visit codestin.com
Credit goes to attack.mitre.org

  1. Home
  2. Data Sources
  3. Active Directory

Active Directory

A database and set of services that allows administrators to manage permissions, access to network resources, and stored data objects (user, group, application, or devices)[1]

ID: DS0026
ⓘ
Platforms: Identity Provider, Windows
ⓘ
Collection Layers: Cloud Control Plane, Host
Contributors: Center for Threat-Informed Defense (CTID)
Version: 1.0
Created: 20 October 2021
Last Modified: 16 April 2025
Version Permalink

Data Components

Active Directory: Active Directory Credential Request

Requests for authentication credentials via Kerberos or other methods like NTLM and LDAP queries. Examples:

  • Kerberos TGT and Service Tickets (Event IDs 4768, 4769)
  • NTLM Authentication Events
  • LDAP Bind Requests

Data Collection Measures:

  • Security Event Logging:
    • Enable "Audit Kerberos Authentication Service" or "Audit Kerberos Service Ticket Operations."
    • Captured Events: IDs 4768, 4769, 4624.
  • Windows Event Forwarding (WEF): Forward domain controller logs to SIEM.
  • SIEM Integration: Use tools like Splunk or Azure Sentinel for log analysis.
  • Kerberos Debug Logging:
    • Registry Key: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters.
    • Set DWORD LogLevel to 1.
  • Azure AD Logs: Monitor Sign-In Logs for authentication and policy issues.
  • Enable EDR Monitoring:
    • Use EDR to detect suspicious processes querying authentication mechanisms (e.g., lsass.exe memory access).

Active Directory: Active Directory Credential Request

Requests for authentication credentials via Kerberos or other methods like NTLM and LDAP queries. Examples:

  • Kerberos TGT and Service Tickets (Event IDs 4768, 4769)
  • NTLM Authentication Events
  • LDAP Bind Requests

Data Collection Measures:

  • Security Event Logging:
    • Enable "Audit Kerberos Authentication Service" or "Audit Kerberos Service Ticket Operations."
    • Captured Events: IDs 4768, 4769, 4624.
  • Windows Event Forwarding (WEF): Forward domain controller logs to SIEM.
  • SIEM Integration: Use tools like Splunk or Azure Sentinel for log analysis.
  • Kerberos Debug Logging:
    • Registry Key: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters.
    • Set DWORD LogLevel to 1.
  • Azure AD Logs: Monitor Sign-In Logs for authentication and policy issues.
  • Enable EDR Monitoring:
    • Use EDR to detect suspicious processes querying authentication mechanisms (e.g., lsass.exe memory access).
Domain ID Name Detects
Enterprise T1649 Steal or Forge Authentication Certificates

Monitor AD CS certificate requests (ex: EID 4886) as well as issued certificates (ex: EID 4887) for abnormal activity, including unexpected certificate enrollments and signs of abuse within certificate attributes (such as abusable EKUs).[2]
Enterprise T1558 Steal or Forge Kerberos Tickets

Monitor for anomalous Kerberos activity, such as malformed or blank fields in Windows logon/logoff events (Event ID 4624, 4672, 4634), RC4 encryption within ticket granting tickets (TGTs), and ticket granting service (TGS) requests without preceding TGT requests.[3][4][5]Monitor the lifetime of TGT tickets for values that differ from the default domain duration.[6] Monitor for indications of Pass the Ticket being used to move laterally.
.001 Golden Ticket

Monitor for anomalous Kerberos activity, such as malformed or blank fields in Windows logon/logoff events (Event ID 4769, 4768), RC4 encryption within TGTs, and TGS requests without preceding TGT requests. Monitor the lifetime of TGT tickets for values that differ from the default domain duration. Monitor for indications of Pass the Ticket being used to move laterally.
.003 Kerberoasting

Monitor for anomalous Kerberos activity, such as enabling Audit Kerberos Service Ticket Operations to log Kerberos TGS service ticket requests. Particularly investigate irregular patterns of activity (ex: accounts making numerous requests, Event ID 4769, within a small time frame, especially if they also request RC4 encryption [Type 0x17]).
.004 AS-REP Roasting

Monitor for anomalous activity, such as enabling Audit Kerberos Service Ticket Operations to log Kerberos TGS service ticket requests. Particularly investigate irregular patterns of activity (ex: accounts making numerous requests, Event ID 4768 and 4769, within a small time frame, especially if they also request RC4 encryption [Type 0x17], pre-authentication not required [Type: 0x0]).
Enterprise T1550 Use Alternate Authentication Material

Monitor requests of new ticket granting ticket or service tickets to a Domain Controller, such as Windows EID 4769 or 4768, that may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.
.002 Pass the Hash

Monitor requests of new ticket granting ticket or service tickets to a Domain Controller. Windows Security events such as 4768 (A Kerberos authentication ticket (TGT) was requested) and 4769 (A Kerberos service ticket was requested) combined with logon session creation information may be indicative of an overpass the hash attempt.
.003 Pass the Ticket

Monitor requests of new ticket granting ticket or service tickets to a Domain Controller. Event ID 4769 is generated on the Domain Controller when using a golden ticket after the KRBTGT password has been reset twice, as mentioned in the mitigation section. The status code 0x1F indicates the action has failed due to "Integrity check on decrypted field failed" and indicates misuse by a previously invalidated golden ticket.[5]

Active Directory: Active Directory Object Access

Object access refers to activities where AD objects (e.g., user accounts, groups, policies) are accessed or queried. Example: Windows Event ID 4661 logs object access attempts. Examples:

  • Attribute Access: e.g., userPassword, memberOf, securityDescriptor.
  • Group Enumeration: Enumerating critical group members (e.g., Domain Admins).
  • User Attributes: Commonly accessed attributes like samAccountName, lastLogonTimestamp.
  • Policy Access: Accessing GPOs to understand security settings.

Data Collection Measures:

  • Audit Policies:
    • Enable "Audit Directory Service Access" under Advanced Audit Policies (Success and Failure).
    • Path: Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Object AccessEnable: Audit Directory Service Access (Success and Failure).
    • Captured Events: IDs 4661, 4662.
  • Event Forwarding: Use WEF to centralize logs for SIEM analysis.
  • SIEM Integration: Collect and parse logs (e.g., 4661, 4662) using tools like Splunk or Azure Sentinel.
  • Log Filtering:
  • Focus on sensitive objects/attributes like:
    • Domain Admins group.
    • userPassword, ntSecurityDescriptor.
  • Enable EDR Monitoring:
    • Detect processes accessing sensitive AD objects (e.g., samAccountName, securityDescriptor).
    • Log all attempts to enumerate critical groups (e.g., "Domain Admins").

Active Directory: Active Directory Object Access

Object access refers to activities where AD objects (e.g., user accounts, groups, policies) are accessed or queried. Example: Windows Event ID 4661 logs object access attempts. Examples:

  • Attribute Access: e.g., userPassword, memberOf, securityDescriptor.
  • Group Enumeration: Enumerating critical group members (e.g., Domain Admins).
  • User Attributes: Commonly accessed attributes like samAccountName, lastLogonTimestamp.
  • Policy Access: Accessing GPOs to understand security settings.

Data Collection Measures:

  • Audit Policies:
    • Enable "Audit Directory Service Access" under Advanced Audit Policies (Success and Failure).
    • Path: Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Object AccessEnable: Audit Directory Service Access (Success and Failure).
    • Captured Events: IDs 4661, 4662.
  • Event Forwarding: Use WEF to centralize logs for SIEM analysis.
  • SIEM Integration: Collect and parse logs (e.g., 4661, 4662) using tools like Splunk or Azure Sentinel.
  • Log Filtering:
  • Focus on sensitive objects/attributes like:
    • Domain Admins group.
    • userPassword, ntSecurityDescriptor.
  • Enable EDR Monitoring:
    • Detect processes accessing sensitive AD objects (e.g., samAccountName, securityDescriptor).
    • Log all attempts to enumerate critical groups (e.g., "Domain Admins").
Domain ID Name Detects
Enterprise T1615 Group Policy Discovery

Monitor for abnormal LDAP queries with filters for groupPolicyContainer and high volumes of LDAP traffic to domain controllers. Windows Event ID 4661 can also be used to detect when a directory service has been accessed.
Enterprise T1003 OS Credential Dumping

Monitor domain controller logs for replication requests and other unscheduled activity possibly associated with DCSync. [7] [8] [9] Note: Domain controllers may not log replication requests originating from the default domain controller account. [10]. Monitor for replication requests [11] from IPs not associated with known domain controllers. [12]

Analytic 1 - Suspicious Replication Requests

sourcetype=WinEventLog:Security EventCode="4662" AND AccessMask= "0x100" AND (guid= "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2" OR guid= "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2" OR guid= "9923a32a-3607-11d2-b9be-0000f87a36b2" OR guid= "89e95b76-444d-4c62-991a-0facbeda640c")

.006 DCSync

Monitor domain controller logs for replication requests and other unscheduled activity possibly associated with DCSync.[7] [8] [9] Note: Domain controllers may not log replication requests originating from the default domain controller account.[10]

Analytic 1 - Monitor for replication requests from IPs not associated with known domain controllers.

index=security sourcetype="WinEventLog:Security" EventCode=4662 AccessMask=0x100 guid IN ("1131f6ad-9c07-11d1-f79f-00c04fc2dcd2", "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2", "9923a32a-3607-11d2-b9be-0000f87a36b2", "89e95b76-444d-4c62-991a-0facbeda640c")

Enterprise T1033 System Owner/User Discovery

Monitor domain controller logs for replication requests and other unscheduled activity possibly associated with DCSync. [7] [8] [9] Note: Domain controllers may not log replication requests originating from the default domain controller account. [10]. Monitor for replication requests [11] from IPs not associated with known domain controllers. [12]

Active Directory: Active Directory Object Creation

Creating new objects in AD, such as user accounts, groups, organizational units (OUs), or trust relationships. Logged as Event ID 5137. Examples:

  • User Account Creation: New user account.
  • Group Creation: New security/distribution group.
  • OU Creation: New organizational unit.
  • Service Account Creation: New service account for automation or malicious tasks.
  • Trust Object Creation: Trust relationship with another domain.

Data Collection Measures:

  • Audit Policy:
    • Enable "Audit Directory Service Changes" (Success and Failure).
    • Path: Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Directory Service Changes.
    • Key Event: Event ID 5137 (object creation).
  • Log Forwarding: Use WEF to centralize logs for SIEM tools (e.g., Splunk).
  • Enable EDR Monitoring:
    • Track processes that create new accounts or modify AD objects.
    • Correlate object creation with suspicious commands (e.g., net user /add).

Active Directory: Active Directory Object Creation

Creating new objects in AD, such as user accounts, groups, organizational units (OUs), or trust relationships. Logged as Event ID 5137. Examples:

  • User Account Creation: New user account.
  • Group Creation: New security/distribution group.
  • OU Creation: New organizational unit.
  • Service Account Creation: New service account for automation or malicious tasks.
  • Trust Object Creation: Trust relationship with another domain.

Data Collection Measures:

  • Audit Policy:
    • Enable "Audit Directory Service Changes" (Success and Failure).
    • Path: Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Directory Service Changes.
    • Key Event: Event ID 5137 (object creation).
  • Log Forwarding: Use WEF to centralize logs for SIEM tools (e.g., Splunk).
  • Enable EDR Monitoring:
    • Track processes that create new accounts or modify AD objects.
    • Correlate object creation with suspicious commands (e.g., net user /add).
Domain ID Name Detects
Enterprise T1098 .001 Account Manipulation: Additional Cloud Credentials

Monitor M365 Audit logs for Add application or Add serviceprincipal operations involving the AzureActiveDirectoryworkloads. Scrutinize extended properties such user agents, app display names, and RequiredAppPermissions (e.g., ImpersonationAccessGrants and DirectAccessGrants).

Analytic 1 - Creation of applications with unusual permissions or from suspicious user agents/IPs.

Note: To detect the creation of potentially malicious applications using hijacked admin credentials or from unusual IP addresses.

"index=""m365_audit_logs"" Workload=""AzureActiveDirectory"" Operation=""Add application""| search ActorUserPrincipalName!=""expected_admin_user""| table CreationTime, ActorUserPrincipalName, IPAddress, ExtendedProperties, ModifiedProperties"

Analytic 2 - Creation of service principals with suspicious user agents or from unusual IP addresses.

Note: To detect the creation of potentially malicious service principals using hijacked admin credentials or from unusual IP addresses.

"index=""m365_audit_logs"" Workload=""AzureActiveDirectory"" Operation=""Add service principal""| search ActorUserPrincipalName!=""expected_admin_user""| table CreationTime, ActorUserPrincipalName, IPAddress, ExtendedProperties, ModifiedProperties"
.005 Account Manipulation: Device Registration

Monitor for the registration or joining of new device objects in Active Directory. Raise alerts when new devices are registered or joined without using MFA.[13]

Analytic 1 - Device registration events with suspicious user agents, unusual OS types, OS versions, or display names.

Note: To detect the registration of potentially malicious devices using hijacked admin credentials or from unusual IP addresses.

index="m365_audit_logs" Workload="AzureActiveDirectory" Operation IN ("Add registered owner to device", "Add device", "Add registered users to device")| search ActorUserPrincipalName!="expected_admin_user"| table CreationTime, ActorUserPrincipalName, IPAddress, ExtendedProperties, ModifiedProperties
Enterprise T1484 Domain or Tenant Policy Modification

Monitor for newly constructed active directory objects, such as Windows EID 5137.
.001 Group Policy Modification

Monitor for newly constructed active directory objects, such as Windows EID 5137.
.002 Trust Modification

Monitor for newly constructed active directory objects, such as Windows EID 5137.
Enterprise T1207 Rogue Domain Controller

Baseline and periodically analyze the Configuration partition of the AD schema and alert on creation of nTDSDSA objects.[14]

Active Directory: Active Directory Object Deletion

Object deletion in AD (e.g., user accounts, groups, OUs) is logged as Event ID 5141. Examples:

  • User Account: Deleted user.
  • Group: Deleted security/distribution group.
  • Organizational Unit (OU): Loss of configurations or policies.
  • Service Account: Disrupted operations or cover tracks.
  • Trust Object: Removed domain trust, disrupting connectivity.

Data Collection Measures:

  • Audit Policy:
    • Enable "Audit Directory Service Changes" (Success and Failure).
    • Path: Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Directory Service Changes.
    • Key Event: Event ID 5141.
  • Log Forwarding: Use WEF to centralize logs for SIEM tools (e.g., Splunk).
  • Enable EDR Monitoring:
    • Detect processes or users that initiate unauthorized object deletions.
    • Monitor tools and scripts that may delete key directory objects.

Active Directory: Active Directory Object Deletion

Object deletion in AD (e.g., user accounts, groups, OUs) is logged as Event ID 5141. Examples:

  • User Account: Deleted user.
  • Group: Deleted security/distribution group.
  • Organizational Unit (OU): Loss of configurations or policies.
  • Service Account: Disrupted operations or cover tracks.
  • Trust Object: Removed domain trust, disrupting connectivity.

Data Collection Measures:

  • Audit Policy:
    • Enable "Audit Directory Service Changes" (Success and Failure).
    • Path: Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Directory Service Changes.
    • Key Event: Event ID 5141.
  • Log Forwarding: Use WEF to centralize logs for SIEM tools (e.g., Splunk).
  • Enable EDR Monitoring:
    • Detect processes or users that initiate unauthorized object deletions.
    • Monitor tools and scripts that may delete key directory objects.
Domain ID Name Detects
Enterprise T1484 Domain or Tenant Policy Modification

Monitor for unexpected deletion of an active directory object, such as Windows EID 5141.
.001 Group Policy Modification

Monitor for unexpected deletion of an active directory object, such as Windows EID 5141.

Active Directory: Active Directory Object Modification

Changes to AD objects (e.g., users, groups, OUs) are logged as Event ID 5136 (Object Modification) or 5163 (Attribute Changes). Examples:

  • User Account: Modifying attributes (e.g., group membership, enabling/disabling accounts).
  • Group Membership: Adding/removing members.
  • OU: Changing properties/permissions (e.g., delegation).
  • Service Account: Modifying SPNs or other attributes.
  • Object Attributes: Changes to passwords, logon hours, or control flags.

Data Collection Measures:

  • Audit Policy:
    • Enable "Audit Directory Service Changes" (Success and Failure).
    • Path: Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Directory Service Changes.
    • Key Events: 5136 (modifications), 5163 (attribute changes).
  • Log Forwarding:
    • Use WEF to centralize logs for SIEM.
    • Parse logs to extract: Object Name, Attribute Changed, Initiator Account Name.
  • Enable EDR Monitoring:
    • Detect changes to critical attributes (e.g., memberOf, logonHours).
    • Track processes modifying directory service objects (e.g., Set-ADUser or dsmod).
  • Enable EDR Monitoring:
    • Detect changes to critical attributes (e.g., memberOf, logonHours).
    • Track processes modifying directory service objects (e.g., Set-ADUser or dsmod).

Active Directory: Active Directory Object Modification

Changes to AD objects (e.g., users, groups, OUs) are logged as Event ID 5136 (Object Modification) or 5163 (Attribute Changes). Examples:

  • User Account: Modifying attributes (e.g., group membership, enabling/disabling accounts).
  • Group Membership: Adding/removing members.
  • OU: Changing properties/permissions (e.g., delegation).
  • Service Account: Modifying SPNs or other attributes.
  • Object Attributes: Changes to passwords, logon hours, or control flags.

Data Collection Measures:

  • Audit Policy:
    • Enable "Audit Directory Service Changes" (Success and Failure).
    • Path: Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Directory Service Changes.
    • Key Events: 5136 (modifications), 5163 (attribute changes).
  • Log Forwarding:
    • Use WEF to centralize logs for SIEM.
    • Parse logs to extract: Object Name, Attribute Changed, Initiator Account Name.
  • Enable EDR Monitoring:
    • Detect changes to critical attributes (e.g., memberOf, logonHours).
    • Track processes modifying directory service objects (e.g., Set-ADUser or dsmod).
  • Enable EDR Monitoring:
    • Detect changes to critical attributes (e.g., memberOf, logonHours).
    • Track processes modifying directory service objects (e.g., Set-ADUser or dsmod).
Domain ID Name Detects
Enterprise T1134 Access Token Manipulation

Monitor for changes made to AD settings that may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls.
.005 SID-History Injection

Monitor for changes to account management events on Domain Controllers for successful and failed changes to SID-History. [15] [16]
Enterprise T1531 Account Access Removal

Monitor for changes made to AD settings for unexpected modifications to user accounts, such as deletions or potentially malicious changes to user attributes (credentials, status, etc.).

Analytic 1 - Unusual password change operations

index="m365_audit_logs" Operation="Change user password"| stats count by Actor, TargetUser| where Actor!="expected_actor" AND TargetUser!="expected_target_user"
Enterprise T1098 Account Manipulation

Monitor for the registration or joining of new device objects in Active Directory. Raise alerts when new devices are registered or joined without using MFA.[13]
.001 Additional Cloud Credentials

Monitor M365 Audit logs for Update application or Update Service principal operations involving the AzureActiveDirectory workloads. Look for suspicious modified properties RequiredResourceAccess changes.

Analytic 1 - Suspicious modifications to RequiredResourceAccess, unexpected user agents, unusual modification times.

Note: To detect suspicious updates to applications which might indicate the granting of unauthorized permissions or impersonation access.

"index=""m365_audit_logs"" Workload=""AzureActiveDirectory"" Operation=""Update application""| search NOT (UserAgent=""expected_user_agent"")| table CreationTime, UserPrincipalName, IPAddress, ExtendedProperties, ModifiedProperties"

Analytic 2 - Suspicious key descriptions, unexpected user agents, unusual modification times.

Note: To detect suspicious updates to application certificates and secrets, which might indicate unauthorized access or changes.

"index=""m365_audit_logs"" Workload=""AzureActiveDirectory"" Operation=""Update application – Certificates and secrets management""| search NOT (UserAgent=""expected_user_agent"")| table CreationTime, UserPrincipalName, IPAddress, ExtendedProperties, ModifiedProperties"

Analytic 3 - Suspicious service principal names, unexpected user agents, unusual modification times.

Note: To detect suspicious updates to service principals, which might indicate unauthorized access or changes.

"index=""m365_audit_logs"" Workload=""AzureActiveDirectory"" Operation=""Update service principal""| search NOT (UserAgent=""expected_user_agent"")| table CreationTime, UserPrincipalName, IPAddress, ExtendedProperties, ModifiedProperties"
Enterprise T1037 Boot or Logon Initialization Scripts

Monitor for changes made in the Active Directory that may use scripts automatically executed at boot or logon initialization to establish persistence.
.003 Network Logon Script

Monitor for changes made in the Active Directory that may use network logon scripts automatically executed at logon initialization to establish persistence.
Enterprise T1671 Cloud Application Integration

Monitor M365 Audit logs for the Operations Add app role assignment grant to user and/or Consent to application occurring against AzureActiveDirectory Workloads.[17]
Enterprise T1484 Domain or Tenant Policy Modification

Monitor for changes made to AD settings for unexpected modifications to user accounts, such as deletions or potentially malicious changes to user attributes (credentials, status, etc.).
.001 Group Policy Modification

Monitor for changes made to AD settings for unexpected modifications to user accounts, such as deletions or potentially malicious changes to user attributes (credentials, status, etc.).
.002 Trust Modification

Monitor for changes made to AD settings for unexpected modifications to domain trust settings, such as when a user or application modifies the federation settings on the domain.
Enterprise T1222 File and Directory Permissions Modification

Monitor for changes made to ACLs and file/directory ownership. Many of the commands used to modify ACLs and file/directory ownership are built-in system utilities and may generate a high false positive alert rate, so compare against baseline knowledge for how systems are typically used and correlate modification events with other indications of malicious activity where possible.
.001 Windows File and Directory Permissions Modification

Monitor for changes made to DACLs and file/directory ownership. Many of the commands used to modify DACLs and file/directory ownership are built-in system utilities and may generate a high false positive alert rate, so compare against baseline knowledge for how systems are typically used and correlate modification events with other indications of malicious activity where possible.
Enterprise T1556 Modify Authentication Process

Monitor for changes made to AD security settings related to MFA logon requirements, such as changes to Azure AD Conditional Access Policies or the registration of new MFA applications.

Monitor for changes made to security settings related to Azure AD Conditional Access Policies. These can be found in the Azure AD audit log under the operation name Update Conditional Access policy.[18]

Analytic 1 - Changes to AD security settings outside of normal maintenance windows.

index=security sourcetype IN ("WinEventLog:Security", "azure:activity", "gsuite:reports:activity", "aws:cloudtrail", "linux_audit", "macos_secure", "network_logs")(EventCode IN (4670, 5136, 5137, 5139, 5141) OR eventName IN ("UpdateUser", "UpdateGroup", "UpdatePolicy", "UpdateRole", "PutRolePolicy", "AttachUserPolicy", "AttachGroupPolicy", "AttachRolePolicy") OR "protoPayload.methodName" IN ("directory.users.update", "admin.directory.group.update", "admin.directory.roleAssignments.update"))

.005 Reversible Encryption

Monitor property changes in Group Policy: Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy\Store passwords using reversible encryption. By default, the property should be set to Disabled.

Analytic 1 - Enabling reversible encryption outside of standard procedures.

index=windows source="WinEventLog:Security" (EventCode=5136 OR EventCode=5137 OR EventCode=5138 OR EventCode=5139)| search AttributeLDAPDisplayName="msDS-User-Account-Control-Computed" OR AttributeLDAPDisplayName="userParameters"| rex field=_raw "ObjectDN=(?P[^,]+)"| eval Modification=if(match(AttributeValue, ".;PwdProperties=1."), "Enabled", "Disabled")| stats count by ObjectDN, Modification, EventCode, AttributeValue| where Modification="Enabled"

.006 Multi-Factor Authentication

Monitor for changes made to AD security settings related to MFA logon requirements, such as changes to Azure AD Conditional Access Policies or the registration of new MFA applications.

.009 Conditional Access Policies

Monitor for changes made to security settings related to Entra ID Conditional Access Policies. For example, these can be found in the Entra ID audit log under the operation name Update Conditional Access policy.[18]
Enterprise T1207 Rogue Domain Controller

Leverage AD directory synchronization (DirSync) to monitor changes to directory state using AD replication cookies.[19] [20] Also consider monitoring and alerting on the replication of AD objects (Audit Detailed Directory Service Replication Events 4928 and 4929). [14]
Enterprise T1528 Steal Application Access Token

Monitor M365 Audit logs for the Operations Add app role assignment grant to user and/or Consent to application occurring against AzureActiveDirectory Workloads.

Analytic 1 - Unusual app role assignments or consents to applications.

index=security sourcetype="WinEventLog:Security" EventCode=5136 OR (index=azuread sourcetype="azure:activity" operationName="Add member to role" OR operationName="Update application" OR operationName="Update servicePrincipal") OR(index=gsuite sourcetype="gsuite:admin" event_type="UPDATE_GROUP" OR event_type="UPDATE_USER") OR(index=o365 sourcetype="o365:management:activity" operation IN ("Add member to role", "Update user", "Update group"))
Enterprise T1649 Steal or Forge Authentication Certificates

Monitor for changes to CA attributes and settings, such as AD CS certificate template modifications (ex: EID 4899/4900 once a potentially malicious certificate is enrolled).[2]

References

  1. Foulds, I. et al. (2018, August 7). AD DS Getting Started. Retrieved September 23, 2021.
  2. Schroeder, W. & Christensen, L. (2021, June 22). Certified Pre-Owned - Abusing Active Directory Certificate Services. Retrieved August 2, 2022.
  3. Metcalf, S. (2015, May 03). Detecting Forged Kerberos Ticket (Golden Ticket & Silver Ticket) Use in Active Directory. Retrieved December 23, 2015.
  4. Jeff Warren. (2019, February 19). How to Detect Pass-the-Ticket Attacks. Retrieved February 27, 2020.
  5. Abolins, D., Boldea, C., Socha, K., Soria-Machado, M. (2016, April 26). Kerberos Golden Ticket Protection. Retrieved July 13, 2017.
  6. Microsoft. (2015, March 24). Kerberos Golden Ticket Check (Updated). Retrieved February 27, 2020.
  7. Microsoft. (2017, December 1). MS-DRSR Directory Replication Service (DRS) Remote Protocol. Retrieved December 4, 2017.
  8. Microsoft. (n.d.). IDL_DRSGetNCChanges (Opnum 3). Retrieved December 4, 2017.
  9. SambaWiki. (n.d.). DRSUAPI. Retrieved December 4, 2017.
  10. Schroeder, W. (2015, September 22). Mimikatz and DCSync and ExtraSids, Oh My. Retrieved December 4, 2017.
  1. Microsoft. (n.d.). MS-SAMR Security Account Manager (SAM) Remote Protocol (Client-to-Server) - Transport. Retrieved December 4, 2017.
  2. Metcalf, S. (2015, September 25). Mimikatz DCSync Usage, Exploitation, and Detection. Retrieved December 4, 2017.
  3. Microsoft. (2020, September 16). Azure Active Directory security operations for devices. Retrieved February 21, 2023.
  4. Delpy, B. & LE TOUX, V. (n.d.). DCShadow. Retrieved March 20, 2018.
  5. Metcalf, S. (2015, September 19). Sneaky Active Directory Persistence #14: SID History. Retrieved November 30, 2017.
  6. Microsoft. (n.d.). Using DsAddSidHistory. Retrieved November 30, 2017.
  7. Mauricio Velazco. (2024, January 4). Hunting M365 Invaders: Blue Team’s Guide to Initial Access Vectors. Retrieved April 3, 2025.
  8. Microsoft. (2023, October 23). Troubleshooting Conditional Access policy changes. Retrieved January 2, 2024.
  9. Microsoft. (n.d.). Polling for Changes Using the DirSync Control. Retrieved March 30, 2018.
  10. Lucand,G. (2018, February 18). Detect DCShadow, impossible?. Retrieved March 30, 2018.