Sigma rule: Possible Shadow Credentials Added

Rule

Title

Possible Shadow Credentials Added

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems), Elastic (idea)

Date

2022-10-17

File

rules/windows/builtin/security/win_security_susp_possible_shadow_credentials_added.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects possible addition of shadow credentials to an active directory object.

Log source

product

windows

service

security

definition

The "Audit Directory Service Changes" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule)

Detection

selection:
    EventID: 5136
    AttributeLDAPDisplayName: 'msDS-KeyCredentialLink'
    # If you experience a lot of FP you could uncomment the selection below
    # There could be other cases for other tooling add them accordingly
    # AttributeValue|contains: 'B:828'
    # OperationType: '%%14674' # Value Added
# As stated in the FP sections it's better to filter out the expected accounts that perform this operation to tighten the logic
# Uncomment the filter below and add the account name (or any other specific field) accordingly
# Don't forget to add it to the condition section below
# filter:
    # SubjectUserName: "%name%"
condition: selection

False positives (as the rule lists them)

• Modifications in the msDS-KeyCredentialLink attribute can be done legitimately by the Azure AD Connect synchronization account or the ADFS service account. These accounts can be added as Exceptions. (From elastic FP section)

Tags

• attack.persistence
• attack.credential-access
• attack.defense-impairment
• attack.t1556

MITRE ATT&CK ids this rule names

• T1556

References

• https://www.elastic.co/guide/en/security/8.4/potential-shadow-credentials-added-to-ad-object.html
• https://cyberstoph.org/posts/2022/03/detecting-shadow-credentials/
• https://twitter.com/SBousseaden/status/1581300963650187264?

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/security/win_security_susp_possible_shadow_credentials_added.yml