Technical Tip: Using FortiAnalyzer to detect activities related to Active Directory privilege escalation vulnerabilities

[fduncan]

Description	This article describes how to use a custom event handler in FortiAnalyzer to raise alerts for incident response related presence of Active Directory elevation of privilege vulnerabilities. This escalation attack allows attackers to elevate their privilege to a Domain Admin once they compromise a regular user in the domain. This vulnerability is assigned CVE-2021-42278 and CVE-2021-42287. For more information about this attack, see the following FortiGuard Outbreak Alert FortiGuard Outbreak Alert - AD Privilege Escalation. What is included in Fortinet_SOC-Active-Directory-Detection-v2.zip? 1. AD Privilege Escalation_event-handler.json This event handler helps identify Active Directory privilege escalation exploit attempts detected in FortiClient and FortiGate IPS logs. 2. ad_privilege_escalation_report.dat This report displays the findings on the Active Directory privilege escalation outbreak from FortiClient and FortiGate IPS logs. 3. fgt_AD Privilege Escalation_event-handler.json The event handler for FortiGate ADOMs which is configured for FortiGate logs only. 4. fgt_Active Directory Privilege Escalation_report.dat The report for FortiGate ADOMs which includes FortiGate charts only.
Scope	This event handler and report utilize FortiGate IPS and FortiClient logs.
Solution	All screen shots provided below for illustration purposes are taken from FortiAnalyzer 7.0.2. 1. Download the Fortinet_SOC_Active-Directory-Detections.v2 file (contains 4 files) 2. Unzip Fortinet_SOC_Active-Directory-Detections.v2 3. Use AD Privilege Escalation_event-handler.json or fgt_AD Privilege Escalation_event-handler.json to import into Event Handlers - Choose an ADOM (if ADOMs are enabled). ADOM may be of type Fabric or FortiGate. - Choose the FortiSOC module - Select Event Handler List - Select the Import option under "More" - Select AD Privilege Escalation_event-handler.json for Fabric ADOMs or fgt_AD Privilege Escalation_event-handler.json for FortiGate ADOMs. Result: The event handler is enabled and will be triggered if the appropriate logs are received after the event handler was imported. 4) Use ad_privilege_escalation_report.dat or fgt_Active Directory Privilege Escalation_report.dat to import into Reports - Choose an ADOM (if ADOMs are enabled). ADOM may be of type Fabric or FortiGate. - Choose the Report module - Select the Import option under "More" - Select ad_privilege_escalation_report.dat for Fabric ADOMs or fgt_Active Directory Privilege Escalation_report.dat for FortiGate ADOMs. Result: ‘AD Privilege Escalation Report’ can be run anytime as determined by an admin user.