Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding AD Privilege Escalation SRS Detections #2664

Merged
merged 24 commits into from
May 26, 2023
Merged

Conversation

mvelazc0
Copy link
Contributor

@mvelazc0 mvelazc0 commented May 3, 2023

Details

This PR includes 5 new SRS detections for Active Directory privilege escalation. All detections have been tested.

New Detections

  • Windows PowerSploit GPP Discovery - PASSED
  • Windows Findstr GPP Discovery - PASSED
  • Windows File Share Discovery With Powerview - PASSED
  • Windows Default Group Policy Object Modified with GPME - PASSED
  • Windows PowerView AD Access Control List Enumeration - PASSED

image

image

image

image

Checklist

  • Validate name matches <platform>_<mitre att&ck technique>_<short description> nomenclature
  • CI/CD jobs passed ✔️
  • Validated SPL logic.
  • Validated tags, description, and how to implement.
  • Verified references match analytic.

@mvelazc0 mvelazc0 added the WIP DO NOT MERGE Work in Progress label May 3, 2023
@mvelazc0 mvelazc0 added 4.3.0 and removed WIP DO NOT MERGE Work in Progress labels May 17, 2023
@patel-bhavin patel-bhavin merged commit 00d0915 into develop May 26, 2023
26 checks passed
@delete-merged-branch delete-merged-branch bot deleted the SRS_AD_PrivEsc branch May 26, 2023 18:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants