KQL Search

Query Details

Security Event Admin SD Holder Modifications

Query

SecurityEvent
| where EventID == 5136 and EventData has "AdminSDHolder"
| project TimeGenerated, Computer, Account, AccountType, SubjectLogonId, Activity, OperationType, EventData
| mv-apply Auxiliar = parse_xml(EventData)["EventData"]["Data"] on (
    summarize BagToUnpack = make_bag(bag_pack(tostring(Auxiliar["@Name"]), tostring(Auxiliar["#text"])))
    )
| evaluate bag_unpack(BagToUnpack, OutputColumnPrefix = "EventData_", columnsConflict="keep_source")
| project-reorder
    TimeGenerated,
    Computer,
    Account,
    AccountType,
    SubjectLogonId,
    Activity,
    OperationType,
    EventData,
    EventData_*

Explanation

This KQL (Kusto Query Language) query is designed to analyze security events related to changes in the "AdminSDHolder" object, which is a special security descriptor in Active Directory. Here's a simplified breakdown of what the query does:

  1. Filter Events: It starts by filtering the SecurityEvent table to only include events with an EventID of 5136, which typically indicates a directory service change, and where the EventData contains the term "AdminSDHolder".

  2. Select Columns: It selects specific columns to display: TimeGenerated, Computer, Account, AccountType, SubjectLogonId, Activity, OperationType, and EventData.

  3. Parse XML Data: The query uses mv-apply to parse the EventData field, which is in XML format. It extracts the data within the <Data> tags and creates a key-value pair (a "bag") for each piece of data.

  4. Unpack Data: It then uses evaluate bag_unpack to expand these key-value pairs into separate columns, prefixing them with "EventData_". This step helps in making the data more accessible and easier to analyze.

  5. Reorder Columns: Finally, it reorders the columns to ensure that the original selected columns are followed by the newly unpacked EventData_ columns.

In summary, this query is extracting and organizing detailed information about changes to the AdminSDHolder object from security events, making it easier to analyze specific changes and their context.

Details

Jose Sebastián Canós profile picture

Jose Sebastián Canós

Released: February 18, 2025

Tables

SecurityEvent

Keywords

SecurityEventEventIDEventDataTimeGeneratedComputerAccountAccountTypeSubjectLogonIdActivityOperationType

Operators

SecurityEvent|where==andhasprojectmv-apply=parse_xml[ ]on(summarizemake_bagbag_packtostring)evaluatebag_unpackOutputColumnPrefixcolumnsConflictproject-reorder

Actions

GitHub