Trying to blacklist all 4662 events except if they match any of the dcsync related GUIDs

[stemerdink]

As we have recently enabled various audit settings on our domain, we now have 4662 events being generated on the DCs.

I am now trying to reduce the number of 4662 events being forwarded to our Splunk backend on the "front end" by tuning the inputs.conf on the DCs. The desired situation is that only events that contain one of the GUIDs that indicate a potential DCSync attack are being forwarded to Splunk:
"Replicating Directory Changes all", "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2" , "1131f6ac-9c07-11d1-f79f-00c04fc2dcd2"or "9923a32a+-3607-11d2-b9be-0000f87a36b2".
(from https://www.praetorian.com/blog/active-directory-visualization-for-blue-teams-and-threat-hunters/)

So dropping all 4662 events, except if they match any of these GUIDs.

I've been playing with the existing blacklist line for events 4662 to fulfil this purpose, but can't seem to get it to work. Not even for one of these GUIDs like for example the below:

blacklist1 = EventCode="4662" Message="Properties:\sControl\sAccess\s^(?!.*{1131f6ac-9c07-11d1-f79f-00c04fc2dcd2})"

Obviously I've restarted the Splunk forwarder after every tweak.

Anybody that can help with compiling a proper blacklist entry?

[livehybrid · Accepted solution]

Hi @stemerdink 

Just to check - when you say it hasnt worked, is this that it excludes all eventCode 4662 or allows all?

I would expect the following to work in this scenario:

blacklist1 = EventCode="4662" Message="(?s)^(?!.*(?:\{?1131f6ad\-9c07\-11d1\-f79f\-00c04fc2dcd2\}?|\{?1131f6aa\-9c07\-11d1\-f79f\-00c04fc2dcd2\}?|\{?9923a32a\-3607\-11d2\-b9be\-0000f87a36b2\}?|\{?1131f6ac\-9c07\-11d1\-f79f\-00c04fc2dcd2\}?)).*"`

This should exclude EventCodee 4662 *unless* one of the GUIDs match.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[stemerdink]

Thanks @livehybrid, preliminary testing shows this seems to be working - great!
Will of course mark as solution after some further testing.

To answer your initial question... it was allowing all 4662 events.

[PickleRick]

Wait a second. Technicalities aside, it seems you're trying to do exactly opposite what you say you want to do.