Skip to content

Commit d327bc5

Browse files
leehinmanjanniten
leehinman
and
janniten
authored
[Winlogbeat] Add Group Management Events - Add NewUAC Description for User Management Events (#14299) (#15153)
* Added Group Management Events * Added User and Group Enumeration * Added New UAC Description (cherry picked from commit 8e31628) Co-authored-by: Anabella Cristaldi <[email protected]>
1 parent a04d657 commit d327bc5

File tree

39 files changed

+1296
-4
lines changed

39 files changed

+1296
-4
lines changed

‎x-pack/winlogbeat/module/security/config/winlogbeat-security.js‎

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,34 @@ var security = (function () {
1919
"11": "CachedInteractive",
2020
};
2121

22+
// User Account Control Attributes Table
23+
// https://support.microsoft.com/es-us/help/305144/how-to-use-useraccountcontrol-to-manipulate-user-account-properties
24+
var uac_flags = [
25+
[0x0001, 'SCRIPT'],
26+
[0x0002, 'ACCOUNTDISABLE'],
27+
[0x0008, 'HOMEDIR_REQUIRED'],
28+
[0x0010, 'LOCKOUT'],
29+
[0x0020, 'PASSWD_NOTREQD'],
30+
[0x0040, 'PASSWD_CANT_CHANGE'],
31+
[0x0080, 'ENCRYPTED_TEXT_PWD_ALLOWED'],
32+
[0x0100, 'TEMP_DUPLICATE_ACCOUNT'],
33+
[0x0200, 'NORMAL_ACCOUNT'],
34+
[0x0800, 'INTERDOMAIN_TRUST_ACCOUNT'],
35+
[0x1000, 'WORKSTATION_TRUST_ACCOUNT'],
36+
[0x2000, 'SERVER_TRUST_ACCOUNT'],
37+
[0x10000, 'DONT_EXPIRE_PASSWORD'],
38+
[0x20000, 'MNS_LOGON_ACCOUNT'],
39+
[0x40000, 'SMARTCARD_REQUIRED'],
40+
[0x80000, 'TRUSTED_FOR_DELEGATION'],
41+
[0x100000, 'NOT_DELEGATED'],
42+
[0x200000, 'USE_DES_KEY_ONLY'],
43+
[0x400000, 'DONT_REQ_PREAUTH'],
44+
[0x800000, 'PASSWORD_EXPIRED'],
45+
[0x1000000, 'TRUSTED_TO_AUTH_FOR_DELEGATION'],
46+
[0x04000000, 'PARTIAL_SECRETS_ACCOUNT'],
47+
];
48+
49+
// event.action Description Table
2250
var eventActionTypes = {
2351
"4624": "logged-in",
2452
"4625": "logon-failed",
@@ -32,10 +60,28 @@ var security = (function () {
3260
"4724": "reset-password",
3361
"4725": "disabled-user-account",
3462
"4726": "deleted-user-account",
63+
"4727": "added-group-account",
64+
"4728": "added-group-account-to",
65+
"4729": "deleted-group-account-from",
66+
"4730": "deleted-group-account",
67+
"4731": "added-group-account",
68+
"4732": "added-group-account-to",
69+
"4733": "deleted-group-account-from",
70+
"4734": "deleted-group-account",
71+
"4735": "modified-group-account",
72+
"4737": "modified-group-account",
3573
"4738": "modified-user-account",
3674
"4740": "locked-out-user-account",
75+
"4754": "added-group-account",
76+
"4755": "modified-group-account",
77+
"4756": "added-group-account-to",
78+
"4757": "deleted-group-account-from",
79+
"4758": "deleted-group-account",
80+
"4764": "type-changed-group-account",
3781
"4767": "unlocked-user-account",
3882
"4781": "renamed-user-account",
83+
"4798": "group-membership-enumerated",
84+
"4799": "user-member-enumerated",
3985
};
4086

4187
// Descriptions of failure status codes.
@@ -1104,6 +1150,28 @@ var security = (function () {
11041150
evt.Put("winlog.logon.failure.sub_status", descriptiveFailureStatus);
11051151
};
11061152

1153+
var addUACDescription = function(evt) {
1154+
var code = evt.Get("winlog.event_data.NewUacValue");
1155+
if (!code) {
1156+
return;
1157+
}
1158+
var uac_code=parseInt(code);
1159+
var uac_result = [];
1160+
for (var i=0; i<uac_flags.length; i++) {
1161+
if ((uac_code | uac_flags[i][0]) === uac_code) {
1162+
uac_result.push(uac_flags[i][1]);
1163+
}
1164+
}
1165+
if (uac_result) {
1166+
evt.Put("winlog.event_data.NewUACList",uac_result);
1167+
}
1168+
var uac_list=evt.Get("winlog.event_data.UserAccountControl").replace(/\s/g,'').split("%%").filter(String);
1169+
if (! uac_list) {
1170+
return;
1171+
}
1172+
evt.Put("winlog.event_data.UserAccountControl",uac_list);
1173+
};
1174+
11071175
var copyTargetUser = new processor.Chain()
11081176
.Convert({
11091177
fields: [
@@ -1115,6 +1183,17 @@ var security = (function () {
11151183
})
11161184
.Build();
11171185

1186+
var copyTargetUserToGroup = new processor.Chain()
1187+
.Convert({
1188+
fields: [
1189+
{from: "winlog.event_data.TargetUserSid", to: "group.id"},
1190+
{from: "winlog.event_data.TargetUserName", to: "group.name"},
1191+
{from: "winlog.event_data.TargetDomainName", to: "group.domain"},
1192+
],
1193+
ignore_missing: true,
1194+
})
1195+
.Build();
1196+
11181197
var copyTargetUserLogonId = new processor.Chain()
11191198
.Convert({
11201199
fields: [
@@ -1304,6 +1383,7 @@ var security = (function () {
13041383
.Add(copyTargetUser)
13051384
.Add(copySubjectUserLogonId)
13061385
.Add(renameCommonAuthFields)
1386+
.Add(addUACDescription)
13071387
.Add(addActionDesc)
13081388
.Build();
13091389

@@ -1313,6 +1393,14 @@ var security = (function () {
13131393
.Add(addActionDesc)
13141394
.Build();
13151395

1396+
var groupMgmtEvts = new processor.Chain()
1397+
.Add(copySubjectUser)
1398+
.Add(copySubjectUserLogonId)
1399+
.Add(copyTargetUserToGroup)
1400+
.Add(renameCommonAuthFields)
1401+
.Add(addActionDesc)
1402+
.Build();
1403+
13161404
return {
13171405
// 4624 - An account was successfully logged on.
13181406
4624: logonSuccess.Run,
@@ -1356,18 +1444,72 @@ var security = (function () {
13561444
// 4726 - An user account was deleted.
13571445
4726: userMgmtEvts.Run,
13581446

1447+
// 4727 - A security-enabled global group was created.
1448+
4727: groupMgmtEvts.Run,
1449+
1450+
// 4728 - A member was added to a security-enabled global group.
1451+
4728: groupMgmtEvts.Run,
1452+
1453+
// 4729 - A member was removed from a security-enabled global group.
1454+
4729: groupMgmtEvts.Run,
1455+
1456+
// 4730 - A security-enabled global group was deleted.
1457+
4730: groupMgmtEvts.Run,
1458+
1459+
// 4731 - A security-enabled local group was created.
1460+
4731: groupMgmtEvts.Run,
1461+
1462+
// 4732 - A member was added to a security-enabled local group.
1463+
4732: groupMgmtEvts.Run,
1464+
1465+
// 4733 - A member was removed from a security-enabled local group.
1466+
4733: groupMgmtEvts.Run,
1467+
1468+
// 4734 - A security-enabled local group was deleted.
1469+
4734: groupMgmtEvts.Run,
1470+
1471+
// 4735 - A security-enabled local group was changed.
1472+
4735: groupMgmtEvts.Run,
1473+
1474+
// 4737 - A security-enabled global group was changed.
1475+
4737: groupMgmtEvts.Run,
1476+
13591477
// 4738 - An user account was changed.
13601478
4738: userMgmtEvts.Run,
13611479

13621480
// 4740 - An account was locked out
13631481
4740: userMgmtEvts.Run,
13641482

1483+
// 4754 - A security-enabled universal group was created.
1484+
4754: groupMgmtEvts.Run,
1485+
1486+
// 4755 - A security-enabled universal group was changed.
1487+
4755: groupMgmtEvts.Run,
1488+
1489+
// 4756 - A member was added to a security-enabled universal group.
1490+
4756: groupMgmtEvts.Run,
1491+
1492+
// 4757 - A member was removed from a security-enabled universal group.
1493+
4757: groupMgmtEvts.Run,
1494+
1495+
// 4758 - A security-enabled universal group was deleted.
1496+
4758: groupMgmtEvts.Run,
1497+
1498+
// 4764 - A group\'s type was changed.
1499+
4764: groupMgmtEvts.Run,
1500+
13651501
// 4767 - A user account was unlocked.
13661502
4767: userMgmtEvts.Run,
13671503

13681504
// 4781 - The name of an account was changed.
13691505
4781: userRenamed.Run,
13701506

1507+
// 4798 - A user's local group membership was enumerated.
1508+
4798: userMgmtEvts.Run,
1509+
1510+
// 4799 - A security-enabled local group membership was enumerated.
1511+
4799: groupMgmtEvts.Run,
1512+
13711513
process: function(evt) {
13721514
var event_id = evt.Get("winlog.event_id");
13731515
var processor = this[event_id];

‎x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4720_Account_Created.evtx.golden.json‎

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,10 @@
3434
"HomeDirectory": "%%1793",
3535
"HomePath": "%%1793",
3636
"LogonHours": "%%1797",
37+
"NewUACList": [
38+
"SCRIPT",
39+
"LOCKOUT"
40+
],
3741
"NewUacValue": "0x15",
3842
"OldUacValue": "0x0",
3943
"PasswordLastSet": "%%1794",
@@ -50,7 +54,11 @@
5054
"TargetDomainName": "WIN-41OB2LO92CR",
5155
"TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1005",
5256
"TargetUserName": "elastictest1",
53-
"UserAccountControl": "\n\t\t%%2080\n\t\t%%2082\n\t\t%%2084",
57+
"UserAccountControl": [
58+
"2080",
59+
"2082",
60+
"2084"
61+
],
5462
"UserParameters": "%%1793",
5563
"UserPrincipalName": "-",
5664
"UserWorkstations": "%%1793"
@@ -110,6 +118,10 @@
110118
"HomeDirectory": "%%1793",
111119
"HomePath": "%%1793",
112120
"LogonHours": "%%1797",
121+
"NewUACList": [
122+
"SCRIPT",
123+
"LOCKOUT"
124+
],
113125
"NewUacValue": "0x15",
114126
"OldUacValue": "0x0",
115127
"PasswordLastSet": "%%1794",
@@ -126,7 +138,11 @@
126138
"TargetDomainName": "WIN-41OB2LO92CR",
127139
"TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1006",
128140
"TargetUserName": "audittest0609",
129-
"UserAccountControl": "\n\t\t%%2080\n\t\t%%2082\n\t\t%%2084",
141+
"UserAccountControl": [
142+
"2080",
143+
"2082",
144+
"2084"
145+
],
130146
"UserParameters": "%%1793",
131147
"UserPrincipalName": "-",
132148
"UserWorkstations": "%%1793"

‎x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4727.evtx‎

68 KB
Binary file not shown.

‎x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4727.evtx.golden.json‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
[
2+
{
3+
"@timestamp": "2019-10-22T11:26:12.4955445Z",
4+
"event": {
5+
"action": "added-group-account",
6+
"code": 4727,
7+
"kind": "event",
8+
"module": "security",
9+
"provider": "Microsoft-Windows-Security-Auditing"
10+
},
11+
"group": {
12+
"domain": "WLBEAT",
13+
"name": "DnsUpdateProxy"
14+
},
15+
"log": {
16+
"level": "information"
17+
},
18+
"message": "A security-enabled global group was created.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-41OB2LO92CR$\n\tAccount Domain:\t\tWLBEAT\n\tLogon ID:\t\t0x27438\n\nNew Group:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1110\n\tGroup Name:\t\tDnsUpdateProxy\n\tGroup Domain:\t\tWLBEAT\n\nAttributes:\n\tSAM Account Name:\tDnsUpdateProxy\n\tSID History:\t\t-\n\nAdditional Information:\n\tPrivileges:\t\t-",
19+
"process": {
20+
"name": "null"
21+
},
22+
"user": {
23+
"domain": "WLBEAT",
24+
"id": "S-1-5-18",
25+
"name": "WIN-41OB2LO92CR$"
26+
},
27+
"winlog": {
28+
"api": "wineventlog",
29+
"channel": "Security",
30+
"computer_name": "WIN-41OB2LO92CR.wlbeat.local",
31+
"event_data": {
32+
"PrivilegeList": "-",
33+
"SamAccountName": "DnsUpdateProxy",
34+
"SidHistory": "-",
35+
"SubjectDomainName": "WLBEAT",
36+
"SubjectLogonId": "0x27438",
37+
"SubjectUserName": "WIN-41OB2LO92CR$",
38+
"SubjectUserSid": "S-1-5-18",
39+
"TargetDomainName": "WLBEAT",
40+
"TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1110",
41+
"TargetUserName": "DnsUpdateProxy"
42+
},
43+
"event_id": 4727,
44+
"keywords": [
45+
"Audit Success"
46+
],
47+
"logon": {
48+
"id": "0x27438"
49+
},
50+
"opcode": "Info",
51+
"process": {
52+
"pid": 772,
53+
"thread": {
54+
"id": 1664
55+
}
56+
},
57+
"provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}",
58+
"provider_name": "Microsoft-Windows-Security-Auditing",
59+
"record_id": 4105,
60+
"task": "Security Group Management"
61+
}
62+
}
63+
]

‎x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4728.evtx‎

68 KB
Binary file not shown.

‎x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4728.evtx.golden.json‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
[
2+
{
3+
"@timestamp": "2019-10-22T11:33:26.8613751Z",
4+
"event": {
5+
"action": "added-group-account-to",
6+
"code": 4728,
7+
"kind": "event",
8+
"module": "security",
9+
"provider": "Microsoft-Windows-Security-Auditing"
10+
},
11+
"group": {
12+
"domain": "WLBEAT",
13+
"name": "test_group2"
14+
},
15+
"log": {
16+
"level": "information"
17+
},
18+
"message": "A member was added to a security-enabled global group.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tAdministrator\n\tAccount Domain:\t\tWLBEAT\n\tLogon ID:\t\t0x4A727\n\nMember:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tCN=Administrator,CN=Users,DC=wlbeat,DC=local\n\nGroup:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1112\n\tGroup Name:\t\ttest_group2\n\tGroup Domain:\t\tWLBEAT\n\nAdditional Information:\n\tPrivileges:\t\t-",
19+
"process": {
20+
"name": "null"
21+
},
22+
"user": {
23+
"domain": "WLBEAT",
24+
"id": "S-1-5-21-101361758-2486510592-3018839910-500",
25+
"name": "Administrator"
26+
},
27+
"winlog": {
28+
"api": "wineventlog",
29+
"channel": "Security",
30+
"computer_name": "WIN-41OB2LO92CR.wlbeat.local",
31+
"event_data": {
32+
"MemberName": "CN=Administrator,CN=Users,DC=wlbeat,DC=local",
33+
"MemberSid": "S-1-5-21-101361758-2486510592-3018839910-500",
34+
"PrivilegeList": "-",
35+
"SubjectDomainName": "WLBEAT",
36+
"SubjectLogonId": "0x4a727",
37+
"SubjectUserName": "Administrator",
38+
"SubjectUserSid": "S-1-5-21-101361758-2486510592-3018839910-500",
39+
"TargetDomainName": "WLBEAT",
40+
"TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1112",
41+
"TargetUserName": "test_group2"
42+
},
43+
"event_id": 4728,
44+
"keywords": [
45+
"Audit Success"
46+
],
47+
"logon": {
48+
"id": "0x4a727"
49+
},
50+
"opcode": "Info",
51+
"process": {
52+
"pid": 772,
53+
"thread": {
54+
"id": 1664
55+
}
56+
},
57+
"provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}",
58+
"provider_name": "Microsoft-Windows-Security-Auditing",
59+
"record_id": 4657,
60+
"task": "Security Group Management"
61+
}
62+
}
63+
]

‎x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4729.evtx‎

68 KB
Binary file not shown.

0 commit comments

Comments
 (0)