Detection proposal: Sysinternals ADExplorer Active Directory snapshots

Abierto
  • ¿Algo no está bien?
#4,393 2 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
55/100
Tipo de issue
Nueva funcionalidad
Claridad
Bien especificado
Estado de actividad
Activo
Área
security

Línea de trabajo

Start with the existing Active Directory Discovery story and related issues #4382 and #4383 to understand how detections are organized. Then inspect the detection content and run contentctl-ng build. Done means both proposed ADExplorer detections build successfully and cover the execution and snapshot behaviors described, including excluding the SchCache schema cache.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

enhancement

Gap. Scattered Spider, LAPSUS$ and ransomware affiliates use Sysinternals ADExplorer to take a full offline snapshot of Active Directory, then convert it for BloodHound or mine it for targets. security_content has no analytic that references ADExplorer (no name, no OriginalFileName, no snapshot file). Sigma has rules keyed on the image name with a -snapshot argument, or on an ADExplorer image writing a .dat file. In my lab each of those caught only 2 of 4 real snapshots: a renamed copy, a GUI menu snapshot and a non-.dat extension each evade at least one of them.

Proposal.

  • Windows Sysinternals ADExplorer Execution (Anomaly, Endpoint.Processes): process name or OriginalFileName AdExp. Triage fields: renamed and snapshot_cli.
  • Windows AD Snapshot Created By ADExplorer (TTP, Sysmon EID 1 + 11): a process with OriginalFileName AdExp that writes any file other than the ADSI schema cache (SchCache\*.sch, written on every connection). This catches renamed copies, GUI snapshots and any extension.

Both would go under the existing Active Directory Discovery story (T1087.002, T1069.002).

Evidence. Windows Server 2025 lab DC with Sysmon 15.22 and 6 cases (4 snapshots, 1 GUI launch without a snapshot, 1 PowerShell LDAP negative). Results: Execution 5/5, Snapshot 4/4, no SchCache false positive. contentctl-ng build passes. Related: #4382, #4383 and the dMSA proposal.

Lenguaje dominante
Python
Estrellas
1.7k
Forks
505
Merge medio
3 d 10 h
PR fusionados (30 d)
43

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de splunk/security_content

Todos los issues de splunk/security_content

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.