Windows Security Event 5136: Suspicious LDAP display names used in directory service changes

title: "Windows Security Event 5136: Suspicious LDAP display names used in directory service changes"
id: 0adfc62a-1a8e-4e1c-813a-cb5c893f8d3c
status: test
description: This rule flags Windows Security Event ID 5136 when specific AttributeLDAPDisplayName values commonly associated with LDAP-based data exchange are observed. Such attributes can be abused by attackers to move or conceal command-and-control data within directory service changes. It relies on Security audit telemetry for directory service changes and checks the LDAP display names present in the event.
references:
  - https://medium.com/@ivecodoe/detecting-ldapfragger-a-newly-released-cobalt-strike-beacon-using-ldap-for-c2-communication-c274a7f00961
  - https://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes/
  - https://github.com/fox-it/LDAPFragger
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_ldap_dataexchange.yml
author: xknow @xknow_infosec, Huntrule Team
date: 2019-03-24
modified: 2022-10-05
tags:
  - attack.t1001.003
  - attack.command-and-control
logsource:
  product: windows
  service: security
  definition: The "Audit Directory Service Changes" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule)
detection:
  selection:
    EventID: 5136
    AttributeValue|contains: "*"
    AttributeLDAPDisplayName:
      - primaryInternationalISDNNumber
      - otherFacsimileTelephoneNumber
      - primaryTelexNumber
  condition: selection
falsepositives:
  - Companies, who may use these default LDAP-Attributes for personal information
level: high
license: DRL-1.1
related:
  - id: d00a9a72-2c09-4459-ad03-5e0a23351e36
    type: derived