Microsoft Telemetry to UDM Mapping: Part 2 - On-Premises Detection

Author:

David Nehoda, Technical Solutions Consultant

Active Directory, Kerberos, Sysmon, and Windows Security Events

---

Overview

This section covers on-premises Microsoft infrastructure: Active Directory, Kerberos authentication, Windows Security events, and Sysmon. These are the sources that capture domain compromise, lateral movement, credential theft, and persistence mechanisms.
 

Section 1: Active Directory On-Premises

Active Directory is where domain compromise becomes inevitable if you cannot see Kerberos, replication, and group changes. The events below are ordered by attack phase.
 

Critical Event IDs
 

Field Mapping: Active Directory Events
 

YARA-L Rules: Active Directory

#### Rule 1: Detect Kerberos RC4 Ticket Forgery (Golden Ticket, Kerberoasting)
 

rule Detect_Kerberos_RC4_Ticket_Forgery {
  meta:
    author = "Detection Engineering"
    description = "Kerberos TGS or TGT request using RC4 encryption. Strong indicator of Golden Ticket, Silver Ticket, or Kerberoasting. Modern Windows uses AES256 by default, so RC4 is an active downgrade attempt."
    severity = "CRITICAL"
    mitre_attack = "T1558.001, T1558.003"

  events:
    $krb.metadata.log_type = "WINEVTLOG"
    ($krb.metadata.product_event_type = "4769" or $krb.metadata.product_event_type = "4768")
    $krb.security_result.detection_fields["TicketEncryptionType"] = "0x17"
    $krb.principal.user.userid = $user
    $krb.principal.ip = $src_ip

  match:
    $user over 10m

  outcome:
    $tickets = count($krb)
    $src_ips = array_distinct($src_ip)
    $service_targets = array_distinct($krb.target.application)

  condition:
    $krb
}

#### Rule 2: Detect AS-REP Roasting Campaign
 

rule Detect_ASREP_Roasting_Campaign {
  meta:
    author = "Detection Engineering"
    description = "Multiple TGT requests with RC4 encryption from one source, targeting distinct users with Kerberos pre-auth disabled. Threshold of 5 distinct users in 15 minutes catches most roasting campaigns."
    severity = "HIGH"
    mitre_attack = "T1558.004"

  events:
    $tgt.metadata.log_type = "WINEVTLOG"
    $tgt.metadata.product_event_type = "4768"
    $tgt.security_result.detection_fields["TicketEncryptionType"] = "0x17"
    $tgt.principal.user.userid = $target_user
    $tgt.principal.ip = $source_ip

  match:
    $source_ip over 15m

  outcome:
    $targeted_accounts = array_distinct($target_user)
    $request_count = count($tgt)

  condition:
    $tgt and $request_count >= 5
}

#### Rule 3: Detect DCSync Credential Replication
 

rule Detect_DCSync_Replication_Access {
  meta:
    author = "Detection Engineering"
    description = "Event 4662 with DS-Replication-Get-Changes GUIDs being used by an account that is not a domain controller or expected replication service account. Signature of DCSync."
    severity = "CRITICAL"
    mitre_attack = "T1003.006"

  events:
    $ds.metadata.log_type = "WINEVTLOG"
    $ds.metadata.product_event_type = "4662"
    ($ds.security_result.detection_fields["Properties"] = /1131f6aa-9c07-11d1-f79f-00c04fc2dcd2/ nocase or
     $ds.security_result.detection_fields["Properties"] = /1131f6ad-9c07-11d1-f79f-00c04fc2dcd2/ nocase or
     $ds.security_result.detection_fields["Properties"] = /89e95b76-444d-4c62-991a-0facbeda640c/ nocase)
    not ($ds.principal.user.userid = /^.*\$/i or
         $ds.principal.user.userid = /^MSOL_.*/i or
         $ds.principal.user.userid = /^AAD_.*/i or
         $ds.principal.user.userid = "krbtgt")
    $ds.principal.user.userid = $user
    $ds.principal.hostname = $dc

  match:
    $dc over 5m

  outcome:
    $accounts = array_distinct($user)

  condition:
    $ds
}

The `not` clause excludes machine accounts (ending in `$`) and known-good Azure AD Connect sync accounts. Anything else requesting replication permissions is DCSync.
 

Section 2: Windows Security Events and Sysmon

Native Security log plus Sysmon together produce the richest endpoint telemetry. Sysmon effectively free and catches Living-off-the-Land techniques that 4688 cannot see.
 

Critical Sysmon Event IDs
 

Field Mapping: Sysmon Events
 

YARA-L Rules: Sysmon & Windows Security

#### Rule 4: LSASS Credential Dumping (Production Grade)

Far stricter than the original. Uses reference list for legitimate LSASS accessors, requires suspicious access mask, correlates to file write.
 

rule Detect_LSASS_Credential_Dump {
  meta:
    author = "Detection Engineering"
    description = "Process opens LSASS with PROCESS_VM_READ or PROCESS_QUERY_INFORMATION, not on known-good list. Optionally correlates to file write in Temp/AppData within 60 seconds (the dump file)."
    severity = "CRITICAL"
    mitre_attack = "T1003.001"

  events:
    $open.metadata.log_type = "WINEVTLOG"
    $open.metadata.event_type = "PROCESS_OPEN"
    re.regex($open.target.process.file.full_path, `(?i).*\\lsass\.exe$`)
    (re.regex($open.security_result.detection_fields["GrantedAccess"], `(?i).*0x1010.*`) or
     re.regex($open.security_result.detection_fields["GrantedAccess"], `(?i).*0x1410.*`) or
     re.regex($open.security_result.detection_fields["GrantedAccess"], `(?i).*0x1438.*`) or
     re.regex($open.security_result.detection_fields["GrantedAccess"], `(?i).*0x143a.*`))
    not $open.principal.process.file.full_path in %trusted_lsass_accessors
    $open.principal.hostname = $host
    $open.principal.process.file.full_path = $accessor

  match:
    $host over 5m

  outcome:
    $accessing_processes = array_distinct($accessor)
    $access_masks = array_distinct($open.security_result.detection_fields["GrantedAccess"])
    $commands = array_distinct($open.principal.process.command_line)

  condition:
    $open
}

Trusted LSASS accessors reference list:

- C:\Windows\System32\csrss.exe

- C:\Windows\System32\wininit.exe

- C:\Windows\System32\services.exe

- C:\Windows\System32\svchost.exe

- C:\Windows\System32\lsm.exe

- C:\Windows\System32\MRT.exe

- C:\Program Files\Windows Defender\MsMpEng.exe

- Your EDR paths (CrowdStrike, SentinelOne, Defender, Carbon Black, Tanium)

- Any backup agent that reads LSASS
 

#### Rule 5: Bring Your Own Vulnerable Driver (BYOVD)
 

rule Detect_BYOVD_Driver_Load {
  meta:
    author = "Detection Engineering"
    description = "Kernel driver loaded from non-standard path or with untrusted/absent signature. BYOVD used by LockBit, BlackByte, Scattered Spider to disable EDR."
    severity = "CRITICAL"
    mitre_attack = "T1068, T1211"

  events:
    $drv.metadata.log_type = "WINEVTLOG"
    $drv.metadata.event_type = "PROCESS_MODULE_LOAD"
    re.regex($drv.target.process.file.full_path, `(?i)\.sys$`)
    (re.regex($drv.target.process.file.full_path, `(?i).*\\(Temp|AppData|ProgramData|Users\\Public|PerfLogs)\\.*`) or
     $drv.security_result.detection_fields["SignatureStatus"] != "Valid" or
     $drv.target.file.is_signed = false)
    $drv.principal.hostname = $host

  match:
    $host over 10m

  outcome:
    $drivers = array_distinct($drv.target.process.file.full_path)
    $hashes = array_distinct($drv.target.process.file.sha256)

  condition:
    $drv
}

Feed hashes into reference list of known-vulnerable-driver hashes (LOLDrivers project) for higher fidelity.
 

#### Rule 6: WMI Event Consumer Persistence
 

rule Detect_WMI_Persistence_Consumer_Binding {
  meta:
    author = "Detection Engineering"
    description = "Permanent WMI event consumer created, filter bound, and binding set. The triad of Sysmon 19 + 20 + 21 indicates persistent WMI subscription, a fileless persistence mechanism."
    severity = "HIGH"
    mitre_attack = "T1546.003"

  events:
    $filter.metadata.log_type = "WINEVTLOG"
    $filter.metadata.product_event_type = "19"
    $filter.principal.hostname = $host

    $consumer.metadata.log_type = "WINEVTLOG"
    $consumer.metadata.product_event_type = "20"
    $consumer.principal.hostname = $host

    $binding.metadata.log_type = "WINEVTLOG"
    $binding.metadata.product_event_type = "21"
    $binding.principal.hostname = $host

    $binding.metadata.event_timestamp.seconds >= $filter.metadata.event_timestamp.seconds
    $binding.metadata.event_timestamp.seconds >= $consumer.metadata.event_timestamp.seconds

  match:
    $host over 30m

  outcome:
    $consumer_cmd = array_distinct($consumer.target.process.command_line)

  condition:
    $filter and $consumer and $binding
}

#### Rule 7: WMIC to PowerShell Execution Chain

Tightened with admin-workstation exclusion so your IT helpdesk doesn't page the SOC.
 

rule Detect_WMIC_Spawning_PowerShell_Or_Cmd {
  meta:
    author = "Detection Engineering"
    description = "wmic.exe spawning powershell or cmd with suspicious arguments. LotL execution chain common to Cobalt Strike, Lumma, Qakbot."
    severity = "HIGH"
    mitre_attack = "T1047"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($proc.principal.process.file.full_path, `(?i).*\\wmic\.exe$`)
    (re.regex($proc.target.process.file.full_path, `(?i).*\\powershell\.exe$`) or
     re.regex($proc.target.process.file.full_path, `(?i).*\\cmd\.exe$`) or
     re.regex($proc.target.process.file.full_path, `(?i).*\\rundll32\.exe$`))
    (re.regex($proc.target.process.command_line, `(?i).*-(enc|ep\s|e\s|ExecutionPolicy\s+Bypass|nop|noni|w\s+hidden).*`) or
     re.regex($proc.target.process.command_line, `(?i).*(DownloadString|IEX|Invoke-Expression|FromBase64String).*`) or
     re.regex($proc.principal.process.command_line, `(?i).*(process\s+call\s+create|\/node:).*`))
    not $proc.principal.hostname in %approved_admin_workstations
    $proc.principal.hostname = $host

  match:
    $host over 10m

  condition:
    $proc
}

#### Rule 8: Remote Service Install Lateral Movement (PSEXEC Pattern)

Service creation for lateral movement shows up in two channels. Correlating both catches PSEXEC, SCShell, custom implants.
 

rule Detect_Remote_Service_Install_Lateral_Movement {
  meta:
    author = "Detection Engineering"
    description = "Remote service installation via 4697 or 7045 from non-standard account, with service binary path pointing at temp directory or unusual location."
    severity = "HIGH"
    mitre_attack = "T1569.002, T1021.002"

  events:
    $svc.metadata.log_type = "WINEVTLOG"
    ($svc.metadata.product_event_type = "4697" or $svc.metadata.product_event_type = "7045")
    (re.regex($svc.target.process.command_line, `(?i).*\\(Temp|AppData|ProgramData|PerfLogs|Users\\Public)\\.*`) or
     re.regex($svc.target.process.command_line, `(?i).*\.(exe|dll|ps1|bat|cmd|vbs).*-(enc|e\s|encoded|nop|ep\s|ExecutionPolicy).*`) or
     re.regex($svc.target.process.command_line, `(?i).*(powershell|cmd\.exe\s+/c|rundll32|regsvr32|mshta).*`))
    $svc.principal.user.userid = $actor
    $svc.target.hostname = $victim

  match:
    $victim over 10m

  outcome:
    $service_cmd = array_distinct($svc.target.process.command_line)

  condition:
    $svc
}

Reference Lists for On-Premises Rules

Build and maintain these reference lists in SecOps:
 

Summary: On-Premises Detection

✅ Understand AD event IDs and Kerberos attack patterns

✅ Know Sysmon events for process, file, registry, and network telemetry

✅ Master field mappings for robust cross-source rules

✅ Deploy production-grade rules: Kerberos, DCSync, LSASS, WMI, WMIC

✅ Maintain reference lists to reduce false positives
 

**Next**: Part 3 covers cloud detection (Entra ID, O365, Defender), cross-source correlation, and validation strategies.