Windows Security Event ID 5136: msDS-KeyCredentialLink Shadow Credentials Added

title: "Windows Security Event ID 5136: msDS-KeyCredentialLink Shadow Credentials Added"
id: 6a443209-60ab-4361-88cc-26dda516c560
status: test
description: This rule flags Windows Security audit events indicating a new value was added to the msDS-KeyCredentialLink attribute on an Active Directory object (EventID 5136). Attackers may use shadow credential mechanisms to establish stealthy authentication paths and persist access while avoiding more obvious credential changes. The detection relies on Directory Service Change auditing (EventID 5136) and the presence of the msDS-KeyCredentialLink LDAP display name in the recorded attribute metadata.
references:
  - https://www.elastic.co/guide/en/security/8.4/potential-shadow-credentials-added-to-ad-object.html
  - https://cyberstoph.org/posts/2022/03/detecting-shadow-credentials/
  - https://twitter.com/SBousseaden/status/1581300963650187264?
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_possible_shadow_credentials_added.yml
author: Nasreddine Bencherchali (Nextron Systems), Elastic (idea), Huntrule Team
date: 2022-10-17
tags:
  - attack.persistence
  - attack.credential-access
  - attack.defense-impairment
  - attack.t1556
logsource:
  product: windows
  service: security
  definition: The "Audit Directory Service Changes" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule)
detection:
  selection:
    EventID: 5136
    AttributeLDAPDisplayName: msDS-KeyCredentialLink
  condition: selection
falsepositives:
  - Modifications in the msDS-KeyCredentialLink attribute can be done legitimately by the Azure AD Connect synchronization account or the ADFS service account. These accounts can be added as Exceptions. (From elastic FP section)
level: high
license: DRL-1.1
related:
  - id: f598ea0c-c25a-4f72-a219-50c44411c791
    type: derived