Detection: Network Traffic to Active Directory Web Services Protocol

Updated Date: 2024-05-18 ID: 68a0056c-34cb-455f-b03d-df935ea62c4f Author: Michael Haag, Splunk Type: Hunting Product: Splunk Enterprise Security

Description

The following analytic identifies network traffic directed to the Active Directory Web Services Protocol (ADWS) on port 9389. It leverages network traffic logs, focusing on source and destination IP addresses, application names, and destination ports. This activity is significant as ADWS is used to manage Active Directory, and unauthorized access could indicate malicious intent. If confirmed malicious, an attacker could manipulate Active Directory, potentially leading to privilege escalation, unauthorized access, or persistent control over the environment.

1
2| tstats count from datamodel=Network_Traffic where All_Traffic.dest_port=9389 by All_Traffic.src_ip, All_Traffic.dest_ip, All_Traffic.app, All_Traffic.user, All_Traffic.dest_port 
3| `security_content_ctime(firstTime)` 
4| `security_content_ctime(lastTime)` 
5| `drop_dm_object_name("All_Traffic")` 
6| `network_traffic_to_active_directory_web_services_protocol_filter`

Data Source

Name Platform Sourcetype Source Supported App
Sysmon EventID 3 Windows icon Windows 'xmlwineventlog' 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational' N/A

Macros Used

Name Value
security_content_ctime convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)
network_traffic_to_active_directory_web_services_protocol_filter search *
network_traffic_to_active_directory_web_services_protocol_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1087.002 Domain Account Discovery
T1069.001 Local Groups Discovery
T1482 Domain Trust Discovery Discovery
T1087.001 Local Account Discovery
T1087 Account Discovery Discovery
T1069.002 Domain Groups Discovery
T1069 Permission Groups Discovery Discovery
KillChainPhase.EXPLOITAITON
NistCategory.DE_AE
Cis18Value.CIS_10
APT41
BRONZE BUTLER
Chimera
Dragonfly
FIN13
FIN6
Fox Kitten
Ke3chang
LAPSUS$
MuddyWater
OilRig
Poseidon Group
Sandworm Team
Scattered Spider
ToddyCat
Turla
Volt Typhoon
Wizard Spider
menuPass
Chimera
HEXANE
OilRig
Tonto Team
Turla
Volt Typhoon
admin@338
Akira
Chimera
Earth Lusca
FIN8
Magic Hound
APT1
APT3
APT32
APT41
Chimera
Fox Kitten
Ke3chang
Moses Staff
OilRig
Poseidon Group
Threat Group-3390
Turla
admin@338
FIN13
Dragonfly
FIN7
Inception
Ke3chang
LAPSUS$
OilRig
ToddyCat
Turla
Volt Typhoon
APT3
APT41
FIN13
TA505

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Risk Event False
This configuration file applies to all detections of type hunting.

Implementation

The detection is based on data that originates from network traffic logs. The logs must contain the source and destination IP addresses, the application name, and the destination port. The logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the network traffic data source. The logs must also be mapped to the Network_Traffic data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.

Known False Positives

False positives should be limited as the destination port is specific to Active Directory Web Services Protocol, however we recommend utilizing this analytic to hunt for non-standard processes querying the ADWS port. Filter by App or dest_ip to AD servers and remove known proceses querying ADWS.

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message Risk Score Impact Confidence
Network traffic to Active Directory Web Services Protocol was identified on $dest_ip$ by $src_ip$. 10 20 50
The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

References

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation ✅ Passing N/A N/A N/A
Unit ✅ Passing Dataset XmlWinEventLog:Microsoft-Windows-Sysmon/Operational xmlwineventlog
Integration ✅ Passing Dataset XmlWinEventLog:Microsoft-Windows-Sysmon/Operational xmlwineventlog

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 3