otrf / set-auditrule Goto Github PK
View Code? Open in Web Editor NEWUseful access control entries (ACE) on system access control list (SACL) of securable objects to find potential adversarial activity
License: GNU General Public License v3.0
Useful access control entries (ACE) on system access control list (SACL) of securable objects to find potential adversarial activity
License: GNU General Public License v3.0
I am searching all over the internet how to make multiple audit rules for a folder or to export and than import multiple audit rules for a file or folder.
With script I can make new audit rule but only 1 rule for 1 user I can't do that for 2 rules and 2 users. Old audit rule is always deleted when using script.
With exporting and importing audit rules that doesn't work.
Is there any soultion for this? Except to do that manually?
Hello,
Thanks for your script which avoided me having to delve too deep in SDDL :)
When using the script to set audit rules for "Read Property" on two specific attributes of an AD object with the -AttributeGUID
parameter, the script overwrite the first one with the second one instead of adding both.
Using $Acl.AddAuditRule($AuditRuleObject)
instead of $Acl.SetAuditRule($AuditRuleObject)
on line 272 correctly adds two rules, but I don't know the impact on other use cases.
Example:
I want to add an audit rule on attributes member
and memberOf
of AdminSDHolder
(which is not possible via GUI because AdminSDHolder
is of type container and this type does not have these attributes). These rules will be propagated by SDProp to e.g. Domain Admins (group) or Administrator (user).
> $AdminSDHolder = "CN=AdminSDHolder,CN=System,DC=EXAMPLE"
> (Get-Acl "ad:\$AdminSDHolder" -Audit).Audit
ActiveDirectoryRights : WriteProperty, WriteDacl, WriteOwner
InheritanceType : None
ObjectType : 00000000-0000-0000-0000-000000000000
IdentityReference : Everyone
IsInherited : False
InheritanceFlags : None
PropagationFlags : None
...
> Set-AuditRule -AdObjectPath "ad:\$AdminSDHolder" -WellKnownSidType NetworkSid -AuditFlags Success,Failure -InheritanceFlags None -Rights ReadProperty -AttributeGUID bf967991-0de6-11d0-a285-00aa003049e2 # memberOf
> (Get-Acl "ad:\$AdminSDHolder" -Audit).Audit
ActiveDirectoryRights : WriteProperty, WriteDacl, WriteOwner
InheritanceType : None
ObjectType : 00000000-0000-0000-0000-000000000000
InheritedObjectType : 00000000-0000-0000-0000-000000000000
ObjectFlags : None
AuditFlags : Success
IdentityReference : Everyone
IsInherited : False
InheritanceFlags : None
PropagationFlags : None
ActiveDirectoryRights : ReadProperty
InheritanceType : None
ObjectType : bf967991-0de6-11d0-a285-00aa003049e2
InheritedObjectType : 00000000-0000-0000-0000-000000000000
ObjectFlags : ObjectAceTypePresent
AuditFlags : Success, Failure
IdentityReference : NT AUTHORITY\NETWORK
IsInherited : False
InheritanceFlags : None
PropagationFlags : None
...
> Set-AuditRule -AdObjectPath "ad:\$AdminSDHolder" -WellKnownSidType NetworkSid -AuditFlags Success,Failure -InheritanceFlags None -Rights ReadProperty -AttributeGUID bf9679c0-0de6-11d0-a285-00aa003049e2 # member
# At this stage, I would expect to have a rule for bf967991-0de6-11d0-a285-00aa003049e2 and one for bf9679c0-0de6-11d0-a285-00aa003049e2
# but only the rule for bf9679c0-0de6-11d0-a285-00aa003049e2 exists
> (Get-Acl "ad:\$AdminSDHolder" -Audit).Audit
ActiveDirectoryRights : WriteProperty, WriteDacl, WriteOwner
InheritanceType : None
ObjectType : 00000000-0000-0000-0000-000000000000
InheritedObjectType : 00000000-0000-0000-0000-000000000000
ObjectFlags : None
AuditFlags : Success
IdentityReference : Everyone
IsInherited : False
InheritanceFlags : None
PropagationFlags : None
ActiveDirectoryRights : ReadProperty
InheritanceType : None
ObjectType : bf9679c0-0de6-11d0-a285-00aa003049e2
InheritedObjectType : 00000000-0000-0000-0000-000000000000
ObjectFlags : ObjectAceTypePresent
AuditFlags : Success, Failure
IdentityReference : NT AUTHORITY\NETWORK
IsInherited : False
InheritanceFlags : None
PropagationFlags : None
...
Instead, when adding the rules with $Acl.AddAuditRule($AuditRuleObject)
:
$AdminSDHolder = "CN=AdminSDHolder,CN=System,DC=EXAMPLE"
$Acl = Get-Acl "ad:\$AdminSDHolder" -Audit
$IdentityReference = New-Object System.Security.Principal.SecurityIdentifier([System.Security.Principal.WellKnownSidType]"NetworkSid", $null)
$Rights = "ReadProperty"
$AuditFlags = "Success","Failure"
$InheritanceFlags = "None"
$AttributeGUID = "bf9679c0-0de6-11d0-a285-00aa003049e2" # member
$AuditRuleObject = New-Object System.DirectoryServices.ActiveDirectoryAuditRule($IdentityReference,$Rights,$AuditFlags,[guid]$AttributeGUID, $InheritanceFlags,[guid]'00000000-0000-0000-0000-000000000000')
$Acl.AddAuditRule($AuditRuleObject)
$AttributeGUID = "bf967991-0de6-11d0-a285-00aa003049e2" # memberOf
$AuditRuleObject = New-Object System.DirectoryServices.ActiveDirectoryAuditRule($IdentityReference,$Rights,$AuditFlags,[guid]$AttributeGUID, $InheritanceFlags,[guid]'00000000-0000-0000-0000-000000000000')
$Acl.AddAuditRule($AuditRuleObject)
Set-Acl "ad:\$AdminSDHolder" $Acl
# Now both rules exist:
> (Get-Acl "ad:\$AdminSDHolder" -Audit).Audit
ActiveDirectoryRights : WriteProperty, WriteDacl, WriteOwner
InheritanceType : None
ObjectType : 00000000-0000-0000-0000-000000000000
InheritedObjectType : 00000000-0000-0000-0000-000000000000
ObjectFlags : None
AuditFlags : Success
IdentityReference : Everyone
IsInherited : False
InheritanceFlags : None
PropagationFlags : None
ActiveDirectoryRights : ReadProperty
InheritanceType : None
ObjectType : bf9679c0-0de6-11d0-a285-00aa003049e2
InheritedObjectType : 00000000-0000-0000-0000-000000000000
ObjectFlags : ObjectAceTypePresent
AuditFlags : Success, Failure
IdentityReference : NT AUTHORITY\NETWORK
IsInherited : False
InheritanceFlags : None
PropagationFlags : None
ActiveDirectoryRights : ReadProperty
InheritanceType : None
ObjectType : bf967991-0de6-11d0-a285-00aa003049e2
InheritedObjectType : 00000000-0000-0000-0000-000000000000
ObjectFlags : ObjectAceTypePresent
AuditFlags : Success, Failure
IdentityReference : NT AUTHORITY\NETWORK
IsInherited : False
InheritanceFlags : None
PropagationFlags : None
...
``
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.