Function: IsDomainController()
Is Domain Controller
Query
// This function validates if a device is a Domain Controller. It will return true when it is a domain controller, alternatively false is returned.
let IsDeviceDomainController = (DeviceNameInput: string) {
let AllDomainControllers =
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where LocalPort == 88
| where LocalIPType == "FourToSixMapping"
| distinct DeviceName;
DeviceNetworkEvents
| summarize arg_max(TimeGenerated, *) by DeviceId
| where DeviceName =~ DeviceNameInput
| extend DomainController = iff(DeviceNameInput in~ (AllDomainControllers), true, false)
| extend DeviceName = DeviceNameInput
| distinct DomainController, DeviceName;
};
// Example
IsDeviceDomainController("yourdevice.tld")About this query
Explanation
This query defines a function called IsDeviceDomainController that checks if a specific device is a Domain Controller. Here's a simple breakdown of how it works:
-
Input: The function takes a device name as input (
DeviceNameInput). -
Identify Domain Controllers:
- It looks at network events from the past 7 days.
- It filters these events to find those where the local port is 88 (commonly used for Kerberos authentication, which is typical for Domain Controllers).
- It further filters for a specific IP type (
FourToSixMapping). - It collects a list of distinct device names that match these criteria, identifying them as Domain Controllers.
-
Check the Input Device:
- It summarizes the most recent network event for each device by
DeviceId. - It checks if the input device name matches any device in the list of identified Domain Controllers.
- It assigns a
trueorfalsevalue to indicate whether the input device is a Domain Controller.
- It summarizes the most recent network event for each device by
-
Output: The function returns whether the specified device is a Domain Controller (
trueorfalse) along with the device name.
The function is implemented similarly in both Defender XDR and Sentinel environments, with minor differences in the timestamp field names (Timestamp vs. TimeGenerated).
Details
Bert-Jan Pals
Released: October 20, 2024
Tables
DeviceNetworkEvents
Keywords
DeviceDomainControllerNetworkEventsTimestampLocalPortIPTypeNameIdTimeGenerated
Operators
letwhereagodistinctsummarizearg_max=~extendiffin~truefalse