Elastic high stable kql

Potential Shadow Credentials added to AD Object

Identify the modification of the msDS-KeyCredentialLink attribute in an Active Directory Computer or User Object. Attackers can abuse control over the object and create a key pair, append to raw public key in the attribute, and obtain persistent and stealthy access to the target user or computer object.

View Source

Detection Logic

event.code:"5136" and host.os.type:"windows" and winlog.event_data.AttributeLDAPDisplayName:"msDS-KeyCredentialLink" and
  winlog.event_data.AttributeValue :B\:828* and
  not winlog.event_data.SubjectUserName: MSOL_* and
  not winlog.event_data.ObjectClass: "msDS-Device"

False Positives

⚠ Azure AD Connect or ADFS provisioning can legitimately modify msDS-KeyCredentialLink when the writer account, source, object class, target DN, bounded change set, and post-change authentication all match an expected workflow.

Field Validations

Loading…

Comments (0)

Loading comments...