Directory and Group Policy

Kind

State - something true when Signal read the host

Built-in rules reading it

0

gpo.guid

string

The Group Policy object's GUID, with braces, upper case - its identity in the directory and its folder's name in SYSVOL (Policies\{GUID}). The same GPO has the same GUID on every host it applies to.

gpo.name

string

The GPO's display name as Group Policy recorded it when applying it to this host (also on a domain controller, for the GPOs that apply to it), else GPT.INI's displayName - which the Group Policy tools do not keep current; absent when neither names it. Chosen by whoever created it, so it can imitate another's.

gpo.version

string

The GPO's version: each edit of its computer settings adds one to the computer number, of its user settings to the user number. A GPO created and never edited is computer 0, user 0.

gpo.created

time

When the GPO's folder was created in SYSVOL on this domain controller - its creation, or when it arrived here by replication; absent on a member.

gpo.changed

time

When the GPO's GPT.INI in SYSVOL was last written (a domain controller): every edit made with the Group Policy tools raises its version there. A file changed in SYSVOL by hand does not, which is why each setting carries its own file's time.

gpo.status

string

Whether the GPO's settings are on: enabled, computer settings disabled, user settings disabled, all settings disabled.

gpo.links

string

Where the GPO is linked, as far as this host knows: the link through which Group Policy applied it here (a domain controller included), and on a domain controller the links its Security log recorded being added (gPLink changes). Absent when not known - never "not linked".

gpo.extensions

string

The Group Policy client-side extensions that process the GPO - how it acts on a host (Scheduled Tasks preferences, Scripts, Files preferences, Registry...). An extension Signal does not name is shown by its GUID.

gpo.applied_to

string

On a member: what the GPO applied to on this host - the computer, or the accounts whose user settings it applied to. Absent on a domain controller's record of the domain's GPOs.

gpo.applied

time

On a member: when Group Policy last wrote its record of the GPOs an extension applied (the History key's last write) - the last change of what applied, not each refresh. Absent when not recorded.

gpo.deploys

string

What the GPO deploys, counted by kind ("1 immediate task, 2 file copy") - each one is its own Group Policy setting record.

gpo.changed_by

string

Who created, changed, linked or deleted the GPO and when, from the domain controller's Security log (5136, 5137, 5141) - only when Directory Service Changes auditing is on.
derived: joined by the Directory module from directory changes on the GPO's object

gpo.in_period

bool

true when the GPO was created or changed inside the period the analyst gave (the profile's window) - by the directory's dates, a setting file's time, or (a member) when it applied; absent when no period was given.
derived: set by the Directory module from gpo.created, gpo.changed, gpo.applied, its settings' times and its since parameter

Kind

State - something true when Signal read the host

Its time is

setting file last written

Built-in rules reading it

11

gpo.guid

string

The Group Policy object's GUID, with braces, upper case - its identity in the directory and its folder's name in SYSVOL (Policies\{GUID}). The same GPO has the same GUID on every host it applies to.

gpo.name

string

The GPO's display name as Group Policy recorded it when applying it to this host (also on a domain controller, for the GPOs that apply to it), else GPT.INI's displayName - which the Group Policy tools do not keep current; absent when neither names it. Chosen by whoever created it, so it can imitate another's.

gpo.links

string

Where the GPO is linked, as far as this host knows: the link through which Group Policy applied it here (a domain controller included), and on a domain controller the links its Security log recorded being added (gPLink changes). Absent when not known - never "not linked".

gpo.applied_to

string

On a member: what the GPO applied to on this host - the computer, or the accounts whose user settings it applied to. Absent on a domain controller's record of the domain's GPOs.

setting.scope

string

computer (applied to the host, as the system) or user (applied to each user it targets, as that user).

setting.kind

string

What the setting deploys: immediate task (runs once, on the next refresh), scheduled task, startup / shutdown / logon / logoff script, file copy, service, registry preference, registry policy, local group, shortcut, service setting or group membership (security template).

setting.action

string

A preference's action: create, replace, update or delete. Absent for settings that have none (scripts, policies).

setting.name

string

The setting's name as written: a task's, a service's, a group's, a registry value's, a script's file.

setting.command

string

The program a task or script runs, as written in the GPO - environment variables unexpanded; a path on a share is fetched by every host the GPO applies to.

setting.arguments

string

The arguments a task or script is run with, as written.

setting.run_as

string

The account a task runs as, or a service's account, as written; absent when not set.

setting.target

string

What the setting acts on: a file copy's destination, a registry key and value, a service's name, a group, a shortcut's path.

setting.value

string

What the setting sets: a registry value's data, a service's start type and action, the members a group setting adds or removes.

setting.source

string

A file copy's source, as written - usually a share every host fetches from.

setting.password

bool

true when the setting stores a password (a preference's cpassword): its encryption key is public, so every account of the domain that can read SYSVOL can read the password.

setting.file

string

The file the setting was read from - in SYSVOL (a domain controller), or Group Policy's own copy on a member - so it can be examined.

setting.changed

time

When the file defining the setting was last written: in SYSVOL, the setting's last edit; in a member's copy, when Group Policy last applied a change to it here.

setting.last_run

time

When a startup or shutdown script last ran on this host, as Group Policy recorded it; absent when not recorded.

setting.in_period

bool

true when the setting's file was written, or its GPO created or changed, inside the period the analyst gave (the profile's window); absent when no period was given.
derived: set by the Directory module from setting.changed and its GPO's dates

Kind

State - something true when Signal read the host

Its time is

file last modified

Built-in rules reading it

2

sysvol.file

string

An executable, installer or script in SYSVOL (NETLOGON included), by its path on the domain controller.

sysvol.kind

string

What the file is: executable, installer or script by its name; "executable named as <ext>" when its first bytes are an executable's and its name says otherwise.

sysvol.size

int

The file's size in bytes.

sysvol.created

time

When the file was created on this domain controller (a file replicated from another DC is created here when it arrives).

sysvol.modified

time

When the file's content was last written.

sysvol.in_period

bool

true when the file was created or written inside the period the analyst gave (the profile's window); absent when no period was given.
derived: set by the Directory module from sysvol.created, sysvol.modified and its since parameter

Kind

Event - something that happened at a time

Its time is

event logged

Built-in rules reading it

0

gp.extension_id

string

The Group Policy client-side extension's GUID, upper case with braces - the part of Windows that applies one kind of setting.

gp.extension_name

string

The client-side extension's name, as the GroupPolicy log writes it (it may be in the system's language).

gp.result

string

How the extension's processing ended: "succeeded" (5016), "completed with warnings" (6016) or "failed" (7016), with the error code when it is not 0.
derived: worded by Signal from the event ID and ErrorCode

log.event_time

time

When a log record was written (its TimeCreated).

Kind

Event - something that happened at a time

Its time is

event logged

Built-in rules reading it

4

directory.operation

string

What happened to the directory object: value added, value deleted (5136 - an attribute changed is a deletion of the old value and an addition of the new), created (5137), moved (5139), deleted (5141).
only recorded when policy.directory_service_changes.success is on

directory.object

string

The directory object's distinguished name (CN=...,DC=...) as the event records it.

directory.class

string

The object's class: user, computer, group, groupPolicyContainer (a GPO), organizationalUnit, domainDNS (the domain itself), container...

directory.object_guid

string

The directory object's GUID (objectGUID) - stable across renames and moves. A GPO's object GUID is not its name GUID (gpo.guid).

directory.attribute

string

The attribute a change wrote (its LDAP name: gPLink, versionNumber, member, msDS-AllowedToDelegateTo, nTSecurityDescriptor...).

directory.value

string

The attribute value a change added or deleted, as the event records it (a security descriptor is SDDL).

directory.operation_id

string

The operation a 5136 belongs to (OpCorrelationID): one change of an attribute is a value deleted and a value added with the same ID - how a gPLink change says which GPO was linked or unlinked.

directory.gpo

string

The GPO a directory change is about, by GUID with braces, upper case: the GPO changed, or the GPO linked or unlinked by a gPLink change. Absent for other objects.
derived: read by the provider from the object's name, or the GUIDs in a gPLink value

log.subject

string

The account (DOMAIN\name) an event's Subject names - who performed the action the event records. A name ending in "$" is a computer account: the machine itself acting (a Group Policy refresh, a service), not a person. Absent when the event names no subject.

log.subject_sid

string

The SID of the account an event's Subject names (who acted) - what identifies it whatever its name.

log.subject_logon_id

string

The logon session (hex) the event's Subject acted in - what ties an action to the logon that preceded it.

log.event_time

time

When a log record was written (its TimeCreated).

Kind

Event - something that happened at a time

Its time is

event logged

Built-in rules reading it

1

directory.object

string

The directory object's distinguished name (CN=...,DC=...) as the event records it.

directory.class

string

The object's class: user, computer, group, groupPolicyContainer (a GPO), organizationalUnit, domainDNS (the domain itself), container...

directory.rights

string

The rights an operation on a directory object used (4662): named for the replication rights Signal knows, the GUID otherwise.

directory.replication

bool

true when an operation used a right to replicate the directory's changes (Replicating Directory Changes, ... All, ... In Filtered Set) - what a domain controller uses, and what DCSync imitates to read every password hash.
derived: read by the provider from directory.rights; only recorded when policy.directory_service_access.success is on

directory.computer_account

bool

Whether the account that acted is a computer account (its name ends in $). Domain controllers replicate as their computer accounts; Signal does not query the directory, so it cannot tell a domain controller's computer account from any other.
derived: read by the provider from log.subject

log.subject

string

The account (DOMAIN\name) an event's Subject names - who performed the action the event records. A name ending in "$" is a computer account: the machine itself acting (a Group Policy refresh, a service), not a person. Absent when the event names no subject.

log.subject_sid

string

The SID of the account an event's Subject names (who acted) - what identifies it whatever its name.

log.subject_logon_id

string

The logon session (hex) the event's Subject acted in - what ties an action to the logon that preceded it.

log.event_time

time

When a log record was written (its TimeCreated).

Kind

Event - something that happened at a time

Its time is

event logged

Built-in rules reading it

0

auth.request

string

What the domain controller recorded: a Kerberos ticket-granting ticket requested (4768), a service ticket requested (4769), Kerberos pre-authentication failed (4771), NTLM credentials validated (4776).

account.name

string

The account (DOMAIN\name, or just name if local) associated with an event. Not marked Identity: an account name is not a stable key on its own (renames, the same name in two domains); account.sid is the key.

account.sid

string

The account's SID - its identity across renames and hosts (a domain account has the same SID everywhere). Timeless, unlike process.pid, so it needs no companion time; the evidence types that carry it name their instances by it (evidence.Type.Identity).

auth.service

string

The service a Kerberos ticket was requested for - an account's name (krbtgt for a ticket-granting ticket).

auth.encryption

string

The ticket's encryption type: AES256, AES128, RC4 (0x17 - a ticket encrypted with the service account's password hash, which can be cracked offline far faster than AES), DES. Absent when the request failed.

auth.preauth

string

The Kerberos pre-authentication type of a ticket-granting ticket request: 0 means none - the account does not require it, so anyone can ask for a ticket encrypted with its password (AS-REP roasting).

auth.status

string

The result code as recorded, with its meaning when Signal knows it (0x18 or 0xC000006A: wrong password; 0x6 or 0xC0000064: no such account).

auth.failed

bool

true when the request failed (a non-zero status).
derived: from auth.status

source.ip

string

The network address a logon-related event says the request came from.

source.workstation

string

The workstation name a logon-related event says the request came from - as reported by the client, so corroborating, not proof.

log.event_time

time

When a log record was written (its TimeCreated).