Skip to main content

Use CasesConfigure Threat Detection, Investigation, and Response (TDIR) Use Case Categories

Configure the Privilege Abuse Use Case

Configure Exabeam Security Operations Platform to protect your environment against the Privilege Abuse use case. Ensure that you collect the right data, set up investigation tools, enable response mechanisms, and import relevant Data Lake reports.

To protect against a use case, you might follow an end-to-end workflow that looks like:

  • Collect – Ensure that you bring in the correct logs for the use case and that all fields populate.

  • Detect – Use out-of-the-box rules and models to identify suspicious activity.

  • Investigate – Ask important questions about the data from log sources, rules, and models.

  • Respond – Isolate, neutralize, eliminate, and mitigate any threats you find.

  • Report – Gather all the evidence in a report so you can share your investigation with others or use for compliance purposes.

Let's configure everything you need to successfully follow each stage of this workflow.

Collect

Collect the data needed to investigate the Privilege Abuse use case and ensure all context tables are populated correctly.

  • Ensure that you contacted Exabeam Customer Success and they helped you onboard and validate the log sources needed to implement the Privilege Abuse use case.

  • Ensure that you have specific out-of-the-box context tables:

    • user_account

    • user_is_executive

    • user_is_privileged

    • is_ad_user

  • Create a custom context table for network zones.

  • Ensure that users and assets have the correct labels based on the context tables. For example, if a user is in the user_is_privileged context table, navigate to the user's profile to verify they have the privileged label.

Detect

Ensure you have all mechanisms in place, like rules, models, watchlists, and Threat Hunter searches, to successfully identify suspicious activity.

Rules and models

Validate out-of-the-box rules and models to ensure you accurately detect anomalous activity.

  • Import the latest content packages on the Exabeam Community. These content packages contain the latest rules and models, which aren't available to install in Content Updates settings. You must download them from the Exabeam Community, then import them.

  • Ensure that related rules and models are triggering correctly.

Threat Hunter searches

To quickly search for events that indicate someone is abusing privileged accounts, create and save the suggested Threat Hunter search queries.

Threat Hunter search

Search criteria

Users who created accounts for the first time

  • Reasons:

    • AM-UD-F

    • AC-LocUA-F

    • AC-UH-F

    • AM-UA-AC-F

  • Dates – Last 7 days

Devices that managed user accounts and groups for the first time

  • Reasons:

    • A-AM-DhU-system-F

    • AM-OH-F

    • AM-UH-A

  • Dates – Last 7 days

Service accounts that abnormally accessed the corporate environment using an asset

  • Reasons:

    • SL-UH-A

    • SL-UH-F

  • Dates – Last 7 days

Service accounts that authenticated using a user or domain account

  • Reasons – SL-UH-I

  • Dates – Last 7 days

Service accounts with a risk score greater than or equal to 60

  • User Labels – service_account

  • Scores – From 60 to <blank>

  • Dates – Last 7 days

Service accounts that triggered security alerts

  • User Labels – service_account

  • Activity Types – Security Alerts

  • Dates – Last 7 days

Administrators with a risk score greater than or equal to 60

  • User Labels – Admin User

  • Scores – From 60 to <blank>

  • Dates – Last 7 days

Administrators who triggered security alerts

  • User Labels – Admin User

  • Activity Types – Security Alerts

  • Dates – Last 7 days

Executives with a risk score greater than or equal to 60

  • User Labels – executive

  • Scores – From 60 to <blank>

  • Dates – Last 7 days

Executives who triggered security alerts

  • User Labels – executive

  • Activity Types – Security Alerts

  • Dates – Last 7 days

Changes to Windows audit activity

  • Activity Types – Windows Audit Change

  • Dates – Last 7 days

Non-executive users who accessed executive assets

  • Reasons:

    • RA-HT-EXEC

    • RA-HT-EXEC-new

    • AL-HT-EXEC

    • AL-HT-EXEC-new

  • Dates – Last 7 days

Configure Settings to Search for Data Lake Logs in Advanced Analytics

If you have an on-premises deployment, ensure that you configure certain Advanced Analytics settings so you can search for Data Lake logs from a Smart Timelines™ event.

If you have a cloud-delivered product offering, ensure that you configure Data Lake as a log source.

Investigate

Ensure you have the tools you need, like tasks and incident types, to investigate the evidence you collect from log sources, rules, and models.

Case Manager Incident Type

In Case Manager, ensure that you have the out-of-the-box Privilege Abuse incident type, or create one if it isn't available out-of-the-box in your Exabeam product offering. Ensure the incident type has all corresponding incident fields.

Case Manager Tasks and Phases

In Case Manager, define a clear response plan to ensure everyone across your organization responds to a Privilege Abuse incident consistently. Under each phase, prescribe the relevant tasks for investigating, containing, and remediating a Privilege Abuse incident.

The out-of-the-box Privilege Abuse incident type comes with suggested phases and tasks. If you don't have the out-of-the-box Privilege Abuse incident type, create the following suggested phases and tasks for your custom Privilege Abuse incident type.

Phase: Detection & Analysis

  1. Task name – Identify suspicious activity

    Task instruction:

    • Determine if the privileged account was misused.

    • Review the privileged account's Smart Timeline™ and determine if it's behaving differently.

    • Determine what kind of privileged account the attacker using; for example, administrator, executive, or service account.

    • Determine what resources the attacker can access based on the rights they have.

  2. Task name – Review the user's profile

    Task instruction:

    • Determine who is acting anomalously.

    • Determine if they're using a domain or local user account.

    • Determine if the activity on the account is consistent with the account's intended function and role.

    • Determine if another user, peer, or anyone else in your organization has done something similar before.

    • Determine if any tickets approved this activity.

  3. Task name – Analyze and scope

    Task instruction:

    • Determine if the user used their workstation or another system that they don't own.

    • Determine if the potentially impacted systems are critical business or infrastructure systems.

    • Determine if the user has done something similar to other systems.

    • Retrospectively search for and identify other potentially impacted systems.

    • Determine if other users did something similar.

    • Find evidence that the account is compromised. If you find evidence, determine who compromised the account.

  4. Task name – Retrospectively search for anomalous activity

    Task instruction:

    • Determine when initial activity likely began and revise this as you investigate and learn new information.

    • Determine if logs from potentially impacted systems were sent to your centralized SIEM or log aggregation platform.

    • Determine if there was any additional anomalous activity, like if the account accessed new applications, triggered security alerts, or exfiltrated data.

    • Determine if any new processes were executed or software was installed. Investigate if the processes or software were used nefariously.

    • Determine if the user disabled any security tools on the endpoint, like Endpoint Detection and Response (EDR), Endpoint Protection Platform (EPP), or Data Loss Prevention (DLP) tools.

  5. Task name – Assess impacted systems

    Task instruction – Determine if the potentially impacted systems are critical business or infrastructure systems.

  6. Task name – Reassess the severity of the incident

    Task instruction – If appropriate, edit the incident priority.

Phase: Containment

  1. Task name – Tell the SOC Manager about the incident

    Task instruction:

    • If needed, inform your SOC Manager of the incident and include the incident's expected start and end date.

    • Determine whether additional team members or teams, like HR, Legal, or Physical Security, must get involved.

  2. Task name – Determine adequate response measures to contain the threat

    Task instruction:

    • Disable the accounts that made unauthorized changes.

    • Quarantine systems to prevent anybody from accessing them. Inform any business and asset owners as needed.

    • For any suspicious accounts, ensure their access is disabled, including access to VPN or SSO.

Phase: Eradication

  1. Task name – Preserve logs for impacted systems and users

    Task instruction:

    • Retrieve and preserve Data Lake logs associated with the user from the expected start to the present.

    • Upload the Data Lake logs to the incident.

    • If there's possible nefarious intent, obtain a forensic image of the system or isolate the physical machine from the network.

  2. Task name – Remediate

    Task instruction – Manually remove remnants like files, Microsoft registry keys, and autostart services, or re-image the impacted systems using the latest enterprise image and updated software patches.

Phase: Recovery

  1. Task name – Proactively check systems.

    Task instruction:

    • Validate systems are running as expected.

    • Analyze and review accounts for suspicious activity.

    • Ensure security monitoring tools are installed on the endpoint.

  2. Task name – Implement relevant global security measures

    Task instruction – Implement security controls to prevent a similar incident from happening.

Phase: Post-Incident Activity

  1. Task name – Update documentation

    Task instruction:

    • Ensure the incident contains documentation of all relevant events and actions taken.

    • Identify methods to improve the team’s response to future incidents.

  2. Task name – Hold post-mortem meeting

    Task instruction:

    • Meet with your team. Review the incident and lessons learned.

    • Document and track administrative and technical gaps identified during the incident.

Case Manager Incident Email Communication

To collaborate on an incident with people across your organization, ensure that you configure incident email communication.

Respond

Enable response mechanisms you need to isolate, neutralize, eliminate, and mitigate any threats you find.

In Incident Responder, create triggers for all turnkey playbooks.

Report

To share your investigation with others or for compliance purposes, ensure you have the relevant out-of-the-box Data Lake reports:

  • Exabeam - Access Grant and Revoke Activity

  • Exabeam - Account Logout Summary

  • Exabeam - Account Management Activity

  • Exabeam - Default Credential Usage and Change Activity

  • Exabeam - Deleted User Account Summary

  • Exabeam - Disabled User Account Summary

  • Exabeam - Policy Activity Summary

  • Exabeam - Privileged Accesses

  • Exabam - Privileged Access - Group Based

  • Exabeam - Privileged Access - User Based

  • Exabeam - Unix User Privilege Elevation

  • Exabeam - User Account Creation Summary

  • Exabeam - Vulnerabilities Detected

  • Exabeam - Windows Audit Failure Summary by Hosts

  • Exabeam - Windows Audit Failure Summary by Users

  • Exabeam - Windows User Privilege Elevation