Aaron Shelmire
@ashelmire3 followers303 downloads86 copies19 likes1,094 views
11 detections
Filters
Last updated
All Time
Detection languages
7
4
Categories
2
2
1
1
1
Platforms
7
1
Products / Services
3
1
1
1
1
MITRE Techniques
5
4
3
2
2
Detects the creation of a new Active Directory forest trust with both FOREST_TRANSITIVE (0x00000008) and CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION (0x00000800) flags set, indicative of the AORTA attack. This rule specifically checks for the TdoAttributes value 0x808, which represents the exact combination of these two flags. Attackers might set additional flags, which would result in a different TdoAttributes value, potentially leading to false negatives. Consider implementing backend-specific bitwise checks if your SIEM supports them for more comprehensive detection.
Page 2 of 2