豆豆友情提示：这是一个非官方 GitHub 代理镜像，主要用于网络测试或访问加速。请勿在此进行登录、注册或处理任何敏感信息。进行这些操作请务必访问官方网站 github.com。 Raw 内容也通过此代理提供。
Skip to content

Commit 78cdc47

Browse files
OddlyOddly
committed
Add FreeIPA detection rules (16 ES|QL rules)
First detection rule coverage for FreeIPA identity management, covering Kerberos authentication attacks, LDAP abuse, IPA API privilege escalation, certificate infrastructure manipulation, and domain policy modification. All rules use ES|QL queries with setup guides, investigation guides, investigation_fields, and MITRE ATT&CK mappings across 9 tactics. All 16 rules confirmed firing on attack simulations against a live FreeIPA 4.12.2 environment with Elastic Agent 9.3.2, with zero false positives from normal operations after tuning. Key findings from live testing: FreeIPA accounts lock out after a few PREAUTH_FAILED errors so the brute force rule counts all failure types; LDAP BIND and RESULT are separate log events so bind brute force matches RESULT tag=97; the IPA API uses ipauserauthtype not user_auth_type as the parameter name; CA role assumption by ipara/pkidbuser is internal and excluded; KDC krbMKey queries to cn=kerberos are internal and excluded.
1 parent c932ece commit 78cdc47

16 files changed

+1733
-0
lines changed

‎rules/integrations/freeipa/collection_freeipa_ldap_mass_data_exfiltration.toml‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
[metadata]
2+
creation_date = "2026/03/28"
3+
integration = ["freeipa"]
4+
maturity = "development"
5+
updated_date = "2026/03/28"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
Identifies LDAP search operations against the FreeIPA 389 Directory Server that return an unusually large number of
11+
entries in a single query. Large result sets from subtree searches against the domain base DN indicate bulk directory
12+
data exfiltration. SSSD clients typically perform targeted searches returning small result sets.
13+
"""
14+
false_positives = [
15+
"""
16+
Legitimate LDAP replication, backup tools, or directory synchronization agents may perform large queries.
17+
Exclude known replication manager DNs and backup service IPs. SSSD clients performing group cache refreshes
18+
may return moderately large result sets but typically stay well below 500 entries per query.
19+
""",
20+
]
21+
from = "now-9m"
22+
interval = "5m"
23+
language = "esql"
24+
license = "Elastic License v2"
25+
name = "FreeIPA LDAP Mass Data Exfiltration"
26+
note = """## Triage and analysis
27+
28+
### Investigating FreeIPA LDAP Mass Data Exfiltration
29+
30+
Large LDAP searches against FreeIPA can expose user details, group memberships, SSH public keys, sudo rules, HBAC policies, and other sensitive directory data. An attacker with authenticated LDAP access can dump the entire directory for offline analysis.
31+
32+
### Possible investigation steps
33+
34+
- Check `freeipa.directory.bind_dn` to identify the account performing the search.
35+
- Review `freeipa.directory.base_dn`, `freeipa.directory.scope`, and `freeipa.directory.filter` to understand what was queried.
36+
- Check `freeipa.directory.entries_returned` to quantify the exposure.
37+
- Correlate with `source.ip` to identify the origin.
38+
- Determine if the bind DN is a legitimate service account, replication manager, or a compromised user.
39+
40+
### Response and remediation
41+
42+
- Block the source IP if unauthorized.
43+
- Reset credentials for the bind DN if compromised.
44+
- Review LDAP ACIs to restrict the maximum entries returned per query.
45+
- Implement `nsslapd-sizelimit` to cap LDAP result sizes for non-admin users.
46+
"""
47+
references = [
48+
"https://attack.mitre.org/techniques/T1213/",
49+
"https://specterops.io/blog/2019/12/04/attacking-freeipa-part-ii-enumeration/",
50+
]
51+
risk_score = 47
52+
rule_id = "f8a1b2c3-4d5e-6f7a-8b9c-0d1e2f3a4b5c"
53+
setup = """## Setup
54+
55+
This rule requires the FreeIPA integration to be installed and configured to collect logs from FreeIPA servers.
56+
57+
### FreeIPA Integration Setup
58+
1. Install the FreeIPA integration in Kibana Fleet.
59+
2. Add the integration to an Elastic Agent policy deployed on your FreeIPA server(s).
60+
3. Ensure the relevant log paths are accessible:
61+
- 389DS access: `/var/log/dirsrv/slapd-*/access` (directory_access data stream)
62+
"""
63+
severity = "medium"
64+
tags = [
65+
"Domain: Identity",
66+
"Data Source: FreeIPA",
67+
"Data Source: FreeIPA Directory Server",
68+
"Use Case: Threat Detection",
69+
"Tactic: Collection",
70+
"Resources: Investigation Guide",
71+
]
72+
timestamp_override = "event.ingested"
73+
type = "esql"
74+
75+
query = '''
76+
from logs-freeipa.directory_access-*
77+
| where freeipa.directory.operation == "RESULT"
78+
and freeipa.directory.entries_returned >= 500
79+
'''
80+
81+
82+
[[rule.threat]]
83+
framework = "MITRE ATT&CK"
84+
[[rule.threat.technique]]
85+
id = "T1213"
86+
name = "Data from Information Repositories"
87+
reference = "https://attack.mitre.org/techniques/T1213/"
88+
89+
90+
[rule.threat.tactic]
91+
id = "TA0009"
92+
name = "Collection"
93+
reference = "https://attack.mitre.org/tactics/TA0009/"
94+
95+
[rule.investigation_fields]
96+
field_names = [
97+
"@timestamp",
98+
"source.ip",
99+
"freeipa.directory.bind_dn",
100+
"freeipa.directory.base_dn",
101+
"freeipa.directory.scope",
102+
"freeipa.directory.filter",
103+
"freeipa.directory.entries_returned",
104+
]

‎rules/integrations/freeipa/credential_access_freeipa_api_password_reset.toml‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
[metadata]
2+
creation_date = "2026/03/28"
3+
integration = ["freeipa"]
4+
maturity = "development"
5+
updated_date = "2026/03/28"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
Identifies a FreeIPA API password reset command (passwd) executed by a principal that is not the target user. An
11+
adversary who has compromised an account with password reset privileges can use this to take over other accounts
12+
without knowing their current password. Self-service password changes are expected and excluded.
13+
"""
14+
false_positives = [
15+
"""
16+
Helpdesk staff or administrators performing authorized password resets will trigger this rule. Exclude known
17+
admin principals if they routinely perform password resets. Automated password rotation systems that use a
18+
service account to reset passwords may also trigger this rule.
19+
""",
20+
]
21+
from = "now-9m"
22+
interval = "5m"
23+
language = "esql"
24+
license = "Elastic License v2"
25+
name = "FreeIPA Password Reset by Another User"
26+
note = """## Triage and analysis
27+
28+
### Investigating FreeIPA Password Reset by Another User
29+
30+
FreeIPA's `passwd` API command allows privileged users to reset another user's password. While this is a legitimate helpdesk operation, it is also a common post-compromise action — an attacker with admin or helpdesk privileges can reset target account passwords to gain access.
31+
32+
### Possible investigation steps
33+
34+
- Identify the actor by examining `user.name` and `user.id` — this is the principal who performed the reset.
35+
- Identify the target account from `freeipa.api.parameters` — this is the account whose password was changed.
36+
- Verify the reset was authorized through a ticket system or change management workflow.
37+
- Check `source.ip` to determine where the reset originated.
38+
- Review the actor's recent API activity for other suspicious commands (role changes, group modifications).
39+
- Check if the target account had subsequent authentication activity from a new or suspicious source.
40+
41+
### Response and remediation
42+
43+
- If unauthorized, immediately reset the target account's password again and revoke all active sessions.
44+
- Investigate the actor's account for compromise — reset their credentials and review their permissions.
45+
- Review who has password reset privileges and apply least privilege principles.
46+
- Consider requiring OTP/2FA for password reset operations.
47+
"""
48+
references = [
49+
"https://attack.mitre.org/techniques/T1098/",
50+
"https://www.freeipa.org/page/V4/OTP",
51+
]
52+
risk_score = 73
53+
rule_id = "5a2c9b06-b1b2-4552-9b82-19646a8bc3ad"
54+
setup = """## Setup
55+
56+
This rule requires the FreeIPA integration to be installed and configured to collect logs from FreeIPA servers.
57+
58+
### FreeIPA Integration Setup
59+
1. Install the FreeIPA integration in Kibana Fleet.
60+
2. Add the integration to an Elastic Agent policy deployed on your FreeIPA server(s).
61+
3. Ensure the relevant log paths are accessible:
62+
- IPA API: `/var/log/httpd/error_log` (ipa_api data stream)
63+
"""
64+
severity = "high"
65+
tags = [
66+
"Domain: Identity",
67+
"Data Source: FreeIPA",
68+
"Data Source: FreeIPA API",
69+
"Use Case: Threat Detection",
70+
"Use Case: Identity and Access Audit",
71+
"Tactic: Credential Access",
72+
"Resources: Investigation Guide",
73+
]
74+
timestamp_override = "event.ingested"
75+
type = "esql"
76+
77+
query = '''
78+
from logs-freeipa.ipa_api-*
79+
| where event.action == "passwd" and event.outcome == "success"
80+
'''
81+
82+
83+
[[rule.threat]]
84+
framework = "MITRE ATT&CK"
85+
[[rule.threat.technique]]
86+
id = "T1098"
87+
name = "Account Manipulation"
88+
reference = "https://attack.mitre.org/techniques/T1098/"
89+
90+
91+
[rule.threat.tactic]
92+
id = "TA0006"
93+
name = "Credential Access"
94+
reference = "https://attack.mitre.org/tactics/TA0006/"
95+
96+
[rule.investigation_fields]
97+
field_names = [
98+
"@timestamp",
99+
"user.name",
100+
"user.id",
101+
"source.ip",
102+
"event.action",
103+
"event.outcome",
104+
"freeipa.api.parameters",
105+
]

‎rules/integrations/freeipa/credential_access_freeipa_kerberos_brute_force.toml‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
[metadata]
2+
creation_date = "2026/03/28"
3+
integration = ["freeipa"]
4+
maturity = "development"
5+
updated_date = "2026/03/28"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
Identifies a high number of Kerberos pre-authentication failures for a single principal from a single source IP,
11+
indicative of a password guessing attack against a FreeIPA KDC. Adversaries may attempt to brute-force Kerberos
12+
credentials to gain initial access to the domain. The default threshold of 25 failures in 5 minutes should be tuned
13+
to match the target environment's normal authentication patterns and lockout policy.
14+
"""
15+
false_positives = [
16+
"""
17+
Misconfigured clients or services with expired credentials may generate repeated pre-authentication failures.
18+
Tune the threshold to match the environment's account lockout policy. Exclude known service accounts or
19+
monitoring systems that perform frequent authentication checks.
20+
""",
21+
]
22+
from = "now-9m"
23+
interval = "5m"
24+
language = "esql"
25+
license = "Elastic License v2"
26+
name = "FreeIPA Kerberos Brute Force Attempt"
27+
note = """## Triage and analysis
28+
29+
### Investigating FreeIPA Kerberos Brute Force Attempt
30+
31+
FreeIPA uses MIT Kerberos for authentication. When a user provides incorrect credentials, the KDC responds with a PREAUTH_FAILED error. A high volume of these errors for a single principal indicates a password guessing attack. This rule uses a threshold that should be tuned to the environment — review the domain's password lockout policy and set the threshold below the lockout limit to catch attacks before lockout occurs.
32+
33+
### Possible investigation steps
34+
35+
- Identify the targeted principal from `freeipa.kdc.client_principal` and determine if it is a high-value account (admin, service account, etc.).
36+
- Check `source.ip` and `source.geo` to determine the origin of the attack. External IPs are higher risk.
37+
- Query for any successful authentication (`event.outcome:success`) for the same principal around the same time window to check if the brute force succeeded.
38+
- Check if the account was locked out by looking for `freeipa.kdc.error_code:LOCKED_OUT` events for the same principal.
39+
- Correlate with the `directory_access` data stream for LDAP bind failures from the same `source.ip`.
40+
- Review whether other principals were also targeted from the same source (indicating password spraying rather than targeted brute force).
41+
42+
### Response and remediation
43+
44+
- If the source is external, block the IP at the firewall or network perimeter.
45+
- If the account was compromised (successful auth observed), reset the password immediately and revoke active Kerberos tickets.
46+
- Review and enforce account lockout policies via `ipa pwpolicy-mod`.
47+
- Consider enabling FreeIPA OTP/2FA for targeted high-value accounts.
48+
- Monitor for follow-up activity from the source IP across all data streams.
49+
"""
50+
references = [
51+
"https://attack.mitre.org/techniques/T1110/001/",
52+
"https://specterops.io/blog/2019/11/25/attacking-freeipa-part-i-authentication/",
53+
"https://book.hacktricks.xyz/linux-hardening/freeipa-pentesting",
54+
]
55+
risk_score = 73
56+
rule_id = "814d541d-24fd-464f-b6a4-38988a18ba55"
57+
setup = """## Setup
58+
59+
This rule requires the FreeIPA integration to be installed and configured to collect logs from FreeIPA servers.
60+
61+
### FreeIPA Integration Setup
62+
1. Install the FreeIPA integration in Kibana Fleet.
63+
2. Add the integration to an Elastic Agent policy deployed on your FreeIPA server(s).
64+
3. Ensure the relevant log paths are accessible:
65+
- KDC: `/var/log/krb5kdc.log` (kdc data stream)
66+
"""
67+
severity = "high"
68+
tags = [
69+
"Domain: Identity",
70+
"Data Source: FreeIPA",
71+
"Data Source: FreeIPA KDC",
72+
"Use Case: Threat Detection",
73+
"Use Case: Identity and Access Audit",
74+
"Tactic: Credential Access",
75+
"Resources: Investigation Guide",
76+
]
77+
timestamp_override = "event.ingested"
78+
type = "esql"
79+
80+
query = '''
81+
from logs-freeipa.kdc-*
82+
| where event.outcome == "failure"
83+
| stats Esql.failure_count = count(*) by freeipa.kdc.client_principal, source.ip
84+
| where Esql.failure_count >= 25
85+
'''
86+
87+
88+
[[rule.threat]]
89+
framework = "MITRE ATT&CK"
90+
[[rule.threat.technique]]
91+
id = "T1110"
92+
name = "Brute Force"
93+
reference = "https://attack.mitre.org/techniques/T1110/"
94+
[[rule.threat.technique.subtechnique]]
95+
id = "T1110.001"
96+
name = "Password Guessing"
97+
reference = "https://attack.mitre.org/techniques/T1110/001/"
98+
99+
100+
[rule.threat.tactic]
101+
id = "TA0006"
102+
name = "Credential Access"
103+
reference = "https://attack.mitre.org/tactics/TA0006/"
104+
105+
[rule.investigation_fields]
106+
field_names = [
107+
"@timestamp",
108+
"source.ip",
109+
"source.geo.country_name",
110+
"freeipa.kdc.client_principal",
111+
"freeipa.kdc.error_code",
112+
"freeipa.kdc.request_type",
113+
"event.outcome",
114+
"Esql.failure_count",
115+
]

0 commit comments

Comments
 (0)