Reversible Encryption

let ReversibleEncryptionEvents = SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4738  // User Account Changed
| extend UserAccountControl = extractjson("$.UserAccountControl", AdditionalInfo)
| where AdditionalInfo has "ENCRYPTED_TEXT_PASSWORD_ALLOWED"
    or AdditionalInfo has "%%2054"  // UserAccountControl flag for reversible encryption
| project TimeGenerated, Computer, TargetUserName, TargetDomainName,
          SubjectUserName, SubjectDomainName, AdditionalInfo;
let PowerShellReversibleEncryption = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any (
    "AllowReversiblePasswordEncryption",
    "ENCRYPTED_TEXT_PASSWORD_ALLOWED",
    "Set-ADUser",
    "Set-ADDefaultDomainPasswordPolicy",
    "New-ADFineGrainedPasswordPolicy"
  )
| where ProcessCommandLine has_any ("$true", "true", "1", "enable")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine;
union ReversibleEncryptionEvents, PowerShellReversibleEncryption
| sort by TimeGenerated desc, Timestamp desc

index=wineventlog sourcetype="WinEventLog:Security" EventCode=4738
| rex field=_raw "(?i)AllowReversiblePasswordEncryption\s*:\s*(?<ReversibleEnabled>\S+)"
| rex field=_raw "\%\%(?<UAC_Flag>2054|2056)"
| where isnotnull(ReversibleEnabled) OR isnotnull(UAC_Flag)
| eval ReversibleSet=if(isnotnull(UAC_Flag) AND UAC_Flag="2054", "ENABLED", "CHECK")
| table _time, host, Target_Account_Name, Target_Domain, Subject_Account_Name, Subject_Domain, ReversibleSet, UAC_Flag
| sort - _time
| append
  [search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
   (Image="*\\powershell.exe" OR Image="*\\pwsh.exe")
   (CommandLine="*AllowReversiblePasswordEncryption*" OR CommandLine="*ENCRYPTED_TEXT_PASSWORD_ALLOWED*")
   (CommandLine="*true*" OR CommandLine="*\$true*" OR CommandLine="*1*")
  | table _time, host, Image, CommandLine, User]

sequence by host.name with maxspan=5m
  [process where event.type == "start"
   and process.name in~ ("powershell.exe", "pwsh.exe")
   and (
     process.args : "*AllowReversiblePasswordEncryption*"
     or process.args : "*ENCRYPTED_TEXT_PASSWORD_ALLOWED*"
     or process.command_line : "*Set-ADUser*"
     or process.command_line : "*Set-ADDefaultDomainPasswordPolicy*"
     or process.command_line : "*New-ADFineGrainedPasswordPolicy*"
   )
   and process.command_line : ("*$true*", "*true*", "* 1 *", "*enable*")]
OR
  [any where event.code == "4738"
   and winlog.event_data.UserAccountControl : "*ENCRYPTED_TEXT_PASSWORD_ALLOWED*"]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  username,
  QIDNAME(qid) AS event_name,
  "Account Name" AS target_account,
  "Account Domain" AS target_domain,
  "Caller User Name" AS subject_account,
  UTF8(payload) AS raw_payload
FROM events
WHERE LOGSOURCETYPEID(logsourceid) = 12
  AND eventid = 4738
  AND (
    UTF8(payload) ILIKE '%ENCRYPTED_TEXT_PASSWORD_ALLOWED%'
    OR UTF8(payload) ILIKE '%%%2054%'
  )
  AND DATEFORMAT(starttime, 'YYYY-MM-dd') >= DATEFORMAT(NOW() - 86400000, 'YYYY-MM-dd')
UNION
SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  username,
  QIDNAME(qid) AS event_name,
  'N/A' AS target_account,
  'N/A' AS target_domain,
  username AS subject_account,
  UTF8(payload) AS raw_payload
FROM events
WHERE LOGSOURCETYPEID(logsourceid) IN (12, 13)
  AND eventid IN (1, 4688)
  AND (
    UTF8(payload) ILIKE '%AllowReversiblePasswordEncryption%'
    OR UTF8(payload) ILIKE '%Set-ADUser%'
    OR UTF8(payload) ILIKE '%Set-ADDefaultDomainPasswordPolicy%'
    OR UTF8(payload) ILIKE '%New-ADFineGrainedPasswordPolicy%'
  )
  AND (
    UTF8(payload) ILIKE '%$true%'
    OR UTF8(payload) ILIKE '%true%'
  )
  AND DATEFORMAT(starttime, 'YYYY-MM-dd') >= DATEFORMAT(NOW() - 86400000, 'YYYY-MM-dd')
ORDER BY starttime DESC
LAST 24 HOURS

// Detection 1: Security Event 4738 with reversible encryption flag
(_sourceCategory=*windows* OR _sourceCategory=*winlogbeat* OR _sourceCategory=*wineventlog*)
| where EventID = "4738"
| parse regex "(?i)UserAccountControl[^:]*:\s*(?<UAC_Changes>[^\n]+)" nodrop
| parse regex "(?i)AllowReversiblePasswordEncryption\s*:\s*(?<ReversibleEncValue>\S+)" nodrop
| parse regex "%%(?<UAC_Flag>2054|2056)" nodrop
| where !isNull(UAC_Flag) OR !isNull(ReversibleEncValue)
| eval ReversibleEnabled = if(UAC_Flag = "2054", "ENABLED", "REVIEW")
| fields _messagetime, _sourceHost, TargetUserName, TargetDomainName, SubjectUserName, SubjectDomainName, ReversibleEnabled, UAC_Flag, UAC_Changes

// Detection 2: PowerShell cmdlets enabling reversible encryption (union via separate search)
// Run separately and merge results:
(_sourceCategory=*windows* OR _sourceCategory=*sysmon*)
| where EventID = "1" OR EventID = "4688"
| where (Image matches "*powershell.exe" OR Image matches "*pwsh.exe"
         OR NewProcessName matches "*powershell.exe")
| where CommandLine matches "*AllowReversiblePasswordEncryption*"
      OR CommandLine matches "*ENCRYPTED_TEXT_PASSWORD_ALLOWED*"
      OR (CommandLine matches "*Set-ADUser*" AND CommandLine matches "*true*")
      OR (CommandLine matches "*Set-ADDefaultDomainPasswordPolicy*" AND CommandLine matches "*true*")
      OR (CommandLine matches "*New-ADFineGrainedPasswordPolicy*" AND CommandLine matches "*true*")
| fields _messagetime, _sourceHost, User, Image, CommandLine

rule t1556_005_reversible_encryption_ad {
  meta:
    author = "Detection Engineering"
    description = "Detects enabling of AllowReversiblePasswordEncryption on AD accounts via Security Event 4738 or PowerShell AD cmdlets — T1556.005"
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "T1556.005"
    severity = "HIGH"
    confidence = "HIGH"

  events:
    (
      // Branch 1: Windows Security Event 4738 with reversible encryption UAC flag
      $e1.metadata.event_type = "USER_CHANGE"
      and $e1.metadata.product_event_type = "4738"
      and (
        re.regex($e1.target.resource.attribute.labels["UserAccountControl"], `(?i)ENCRYPTED_TEXT_PASSWORD_ALLOWED`)
        or re.regex($e1.metadata.description, `%%2054`)
        or re.regex($e1.metadata.description, `(?i)ENCRYPTED_TEXT_PASSWORD_ALLOWED`)
      )
    )
    or
    (
      // Branch 2: PowerShell process invoking AD reversible encryption cmdlets
      $e1.metadata.event_type = "PROCESS_LAUNCH"
      and (
        re.regex($e1.principal.process.file.full_path, `(?i)(powershell|pwsh)\.exe$`)
        or re.regex($e1.target.process.file.full_path, `(?i)(powershell|pwsh)\.exe$`)
      )
      and re.regex($e1.target.process.command_line, `(?i)(AllowReversiblePasswordEncryption|ENCRYPTED_TEXT_PASSWORD_ALLOWED|Set-ADDefaultDomainPasswordPolicy|New-ADFineGrainedPasswordPolicy)`)
      and re.regex($e1.target.process.command_line, `(?i)(\$true|\btrue\b|\s1\s|enable)`)
    )

  condition:
    $e1
}

// Detection 1: PowerShell enabling reversible encryption via process events
#event_simpleName = "ProcessRollup2"
| ImageFileName = /(?i)(powershell|pwsh)\.exe$/
| CommandLine = /(?i)(AllowReversiblePasswordEncryption|ENCRYPTED_TEXT_PASSWORD_ALLOWED|Set-ADDefaultDomainPasswordPolicy|New-ADFineGrainedPasswordPolicy)/
| CommandLine = /(?i)(\$true|\btrue\b|enable)/
| select([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, ProcessStartTime, ParentProcessId, TargetProcessId])
| sort(field=@timestamp, order=desc)

// Detection 2: Script block logging for reversible encryption (run separately)
#event_simpleName = "ScriptControlScanTelemetry"
| ScriptContent = /(?i)(AllowReversiblePasswordEncryption|ENCRYPTED_TEXT_PASSWORD_ALLOWED)/
| ScriptContent = /(?i)(\$true|\btrue\b|Set-ADUser|Set-ADDefaultDomainPasswordPolicy)/
| select([@timestamp, ComputerName, UserName, ScriptContent, SHA256HashData])
| sort(field=@timestamp, order=desc)