Denied RODC Password Replication Group Changed

Description

field win.eventdata.targetSid="^S-1-5-21\S+-572$"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

1. 60000 Group of windows rules. anchor level 0
   decoded_as=windows_eventchannel AND field win.system.providerName="\.+"
2. 60001 Group of Windows rules for the security channel. anchor level 0
   field win.system.channel="^Security$"
3. 60103 Windows audit success event anchor level 0
   field win.system.severityValue="^AUDIT_SUCCESS$|^success$"
4. 60113 Group Account Changed anchor level 5
   field win.system.eventID="^632$|^4728$|^633$|^4729$|^636$|^4732$|^637$|^4733$|^639$|^4735$| |^641$|^4737$|^637$|^4733$|^659$|^4755$|^660$|^4766$|^668$|^4764$| |^649$|^4745$|^650$|^4746$|^651$|^4747$|^654$|^4750$|^655$|^4751$| |^656$|^4752$|^659$|^4755$|^660$|^4756$|^661$|^4757$|^664$|^4760$| |^665$|^4761$|^666$|^4762$"
5. 60144 Security Enabled Local Group Member Added · win.system.eventID = 636$|^4732 anchor level 5
   field win.system.eventID="^636$|^4732$"
6. 60191 Denied RODC Password Replication Group Changed refinement level 10 this rule
   field win.eventdata.targetSid="^S-1-5-21\S+-572$"

Rule dependencies

Depends on

• composes · Wazuh if_sid 60144
  • Security Enabled Local Group Member Added · win.system.eventID = 636$|^4732
• composes · Wazuh if_sid 60145
  • Security Enabled Local Group Member Removed · win.system.eventID = 637$|^4733