Skip to main content
Version: 6.2

Cyber Security: Active Directory Source

Source Description​

This source combines event logs from Active Directory domain controllers. Its rules detect attacks on Kerberos and NTLM authentication, password brute-force attempts and spraying, changes to privileged groups and directory objects, replication attacks (DCSync and DCShadow), and attacks on Active Directory Certificate Services (AD CS).

The rules analyze authentication and directory change events on domain controllers and correlate events across controllers. To detect directory attack tools, they also use events from domain hosts.

Collection Requirements​

  • collect the Security log from all domain controllers. If a controller is omitted, the rules can miss attacks and produce false positives when correlating events across controllers
  • enable the domain controller audit policy, including Directory Service Access, Directory Service Changes, Kerberos Authentication Service, Kerberos Service Ticket Operations, Computer Account Management, and Certification Services; see Configuring Infrastructure Sources
  • configure system access control lists (SACLs) on directory objects for events 4662 and 5136

MITRE ATT&CK Coverage​

The source rules cover the following tactics.

  • reconnaissance
  • initial access
  • execution
  • persistence
  • privilege escalation
  • stealth
  • defense impairment
  • credential access
  • discovery
  • lateral movement
  • collection
  • command and control
  • exfiltration
  • impact

Lookups​

The source rules enrich incidents with context from infrastructure and account lookups, while exclusion lookups filter out legitimate activity. See Lookups for population requirements.

Documents Included with the Module

The "Cyber Security Expertise Description" document included with the module lists the source rules, their MITRE ATT&CK tactics and techniques, identifiers, and lookups.