Development of a rule-based approach for detecting cyber attacks on windows domain systems

Domain systems, in addition to essential functions such as identity management, access controls, and authorization, also store valuable information contained within objects. Attackers who infiltrate a system often target the domain system because they know it is central to these functions. By directly targeting the domain service, they can steal credentials, gain access to users' and groups' permissions, and potentially access confidential data with unauthorized users, or even spread to other systems and escalate their privileges. Moreover, they can maintain persistence within the system, enabling them to access it without needing to breach it again, cause service disruptions on devices within the Domain structure, access users' private information to employ social engineering tactics, or encrypt the information stored in the domain system to demand ransom. Such attacks, or similar malicious attempts, not only disrupt the operation of the targeted system but also inflict significant financial losses and reputational damage on the organization. This can undermine the organization's credibility, create a negative perception among customers and business partners in the long term, and even threaten the organization's ability to continue its operations. Considering the critical role that the domain system plays in regulating access to a company's sensitive data and resources, it is imperative for organizations to take proactive measures to defend against such attacks. Protecting Active Directory systems is a critical focus for security teams. Identifying these attacks and having knowledge about attacks targeting domain systems provide a significant advantage for cybersecurity teams. Developing Sigma rules to detect these types of cyberattacks and counter such threats is an important aspect. This thesis has developed a rule-based approach for detecting cyberattacks targeting Windows Domain systems. By leveraging Sigma rules, it identifies various attack vectors in Active Directory environments and provides effective detection methods against these threats. Accordingly, it offers a solution that guides organizations' cybersecurity teams in their attack detection and prevention processes. With this approach, the thesis contributes to minimizing potential damages by enabling the early detection of attacks, particularly focusing on the protection of critical data and resources.