{"id":"35ba1d85-724d-42a3-889f-2e2362bcaf23","title":"AD Privileged Users or Groups Reconnaissance","description":"Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs","author":"Samir Bousseaden","status":"test","level":"high","date":"2019-04-03","modified":"2022-07-13","tags":["attack.discovery","attack.t1087.002"],"technique_ids":["T1087.002"],"logsource":{"product":"windows","service":"security","definition":"Requirements: enable Object Access SAM on your Domain Controllers"},"falsepositives":["If source account name is not an admin then its super suspicious"],"references":["https://web.archive.org/web/20230329163438/https://blog.menasec.net/2019/02/threat-hunting-5-detecting-enumeration.html"],"source_path":"rules/windows/builtin/security/win_security_account_discovery.yml","source_sha256":"ad85d022b60f700ff984ffbd111f9ba57469bba8b675a79acf3f92c69ad7ea88","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_account_discovery.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: AD Privileged Users or Groups Reconnaissance\nid: 35ba1d85-724d-42a3-889f-2e2362bcaf23\nstatus: test\ndescription: Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs\nreferences:\n    - https://web.archive.org/web/20230329163438/https://blog.menasec.net/2019/02/threat-hunting-5-detecting-enumeration.html\nauthor: Samir Bousseaden\ndate: 2019-04-03\nmodified: 2022-07-13\ntags:\n    - attack.discovery\n    - attack.t1087.002\nlogsource:\n    product: windows\n    service: security\n    definition: 'Requirements: enable Object Access SAM on your Domain Controllers'\ndetection:\n    selection:\n        EventID: 4661\n        ObjectType:\n            - 'SAM_USER'\n            - 'SAM_GROUP'\n    selection_object:\n        - ObjectName|endswith:\n              - '-512'\n              - '-502'\n              - '-500'\n              - '-505'\n              - '-519'\n              - '-520'\n              - '-544'\n              - '-551'\n              - '-555'\n        - ObjectName|contains: 'admin'\n    filter:\n        SubjectUserName|endswith: '$'\n    condition: selection and selection_object and not filter\nfalsepositives:\n    - If source account name is not an admin then its super suspicious\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1087.002","id":"T1087.002","name":"Domain Account","page":"techniques/enterprise/T1087.002/"}],"data_path":"data/detection-rules/35ba1d85-724d-42a3-889f-2e2362bcaf23.json","kind":"sigma"}