Detection of Windows Privileged Group Modifications

This brief addresses the threat of unauthorized modifications to privileged groups in Active Directory. The focus is on identifying when actors create, delete, or alter memberships of sensitive groups such as "Domain Admins", "Enterprise Admins", and "ESX Admins". Such actions can be indicative of malicious activity, particularly in the context of exploiting vulnerabilities like CVE-2024-37085, the VMware ESXi Active Directory Integration Authentication Bypass. Successful exploitation could allow attackers to escalate privileges and gain control over critical systems. The detection relies on analyzing Windows Security Event logs, specifically Event Codes 4727, 4731, 4744, 4749, 4754, 4756, 4759, 4783, and 4790. Timely detection of these modifications is crucial for preventing lateral movement and data breaches within the network.

Attack Chain

1. Initial Access: An attacker gains initial access to a system within the target network, potentially through exploiting CVE-2024-37085.
2. Privilege Escalation: The attacker attempts to elevate privileges by exploiting existing vulnerabilities or misconfigurations within the system.
3. Group Enumeration: The attacker enumerates existing Active Directory groups, specifically targeting privileged groups such as "Domain Admins" and "Enterprise Admins".
4. Group Modification: The attacker modifies a privileged group, adding a compromised account or creating a new account with elevated privileges. This involves generating Windows Security Event logs 4727, 4731, 4744, 4749, 4754, 4756, 4759, 4783, and 4790.
5. Credential Access: With elevated privileges, the attacker accesses sensitive credentials and resources within the network.
6. Lateral Movement: The attacker uses the compromised credentials to move laterally to other systems and resources within the network.
7. Data Exfiltration/Ransomware Deployment: The attacker exfiltrates sensitive data or deploys ransomware across the compromised systems.

Impact

Compromising privileged groups within Active Directory can lead to widespread damage across the entire network. Attackers can gain complete control over domain controllers, critical servers, and user accounts. The manipulation of "Domain Admins" or "Enterprise Admins" groups grants attackers unrestricted access to sensitive data, intellectual property, and financial records. In cases involving CVE-2024-37085, the impact is amplified by the potential for widespread ransomware deployment across VMware ESXi environments. The result can be significant financial losses, reputational damage, and regulatory penalties.

Recommendation

• Enable Windows Security Event logging for Event IDs 4727, 4731, 4744, 4749, 4754, 4756, 4759, 4783, and 4790 to ensure visibility into group modification events.
• Deploy the provided Sigma rules to your SIEM to detect unauthorized modifications to privileged groups in Active Directory.
• Investigate and patch CVE-2024-37085 on all VMware ESXi servers to prevent attackers from gaining initial access.
• Review and harden Active Directory group policies to minimize the risk of unauthorized group modifications.