{"id":"968eef52-9cff-4454-8992-1e74b9cbad6c","title":"Reconnaissance Activity","description":"Detects activity as \"net user administrator /domain\" and \"net group domain admins /domain\"","author":"Florian Roth (Nextron Systems), Jack Croock (method), Jonhnathan Ribeiro (improvements), oscd.community","status":"test","level":"high","date":"2017-03-07","modified":"2022-08-22","tags":["attack.discovery","attack.t1087.002","attack.t1069.002","attack.s0039"],"technique_ids":["T1069.002","T1087.002"],"logsource":{"product":"windows","service":"security","definition":"The volume of Event ID 4661 is high on Domain Controllers and therefore \"Audit SAM\" and \"Audit Kernel Object\" advanced audit policy settings are not configured in the recommendations for server systems"},"falsepositives":["Administrator activity"],"references":["https://findingbad.blogspot.de/2017/01/hunting-what-does-it-look-like.html"],"source_path":"rules/windows/builtin/security/win_security_susp_net_recon_activity.yml","source_sha256":"a37daf3574b965744b3977e4c8c9f11042aaa4148ce68ef26aec85607bef2118","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_susp_net_recon_activity.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Reconnaissance Activity\nid: 968eef52-9cff-4454-8992-1e74b9cbad6c\nstatus: test\ndescription: Detects activity as \"net user administrator /domain\" and \"net group domain admins /domain\"\nreferences:\n    - https://findingbad.blogspot.de/2017/01/hunting-what-does-it-look-like.html\nauthor: Florian Roth (Nextron Systems), Jack Croock (method), Jonhnathan Ribeiro (improvements), oscd.community\ndate: 2017-03-07\nmodified: 2022-08-22\ntags:\n    - attack.discovery\n    - attack.t1087.002\n    - attack.t1069.002\n    - attack.s0039\nlogsource:\n    product: windows\n    service: security\n    definition: The volume of Event ID 4661 is high on Domain Controllers and therefore \"Audit SAM\" and \"Audit Kernel Object\" advanced audit policy settings are not configured in the recommendations for server systems\ndetection:\n    selection:\n        EventID: 4661\n        AccessMask: '0x2d'\n        ObjectType:\n            - 'SAM_USER'\n            - 'SAM_GROUP'\n        ObjectName|startswith: 'S-1-5-21-'\n        ObjectName|endswith:\n            - '-500'\n            - '-512'\n    condition: selection\nfalsepositives:\n    - Administrator activity\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1069.002","id":"T1069.002","name":"Domain Groups","page":"techniques/enterprise/T1069.002/"},{"key":"enterprise/T1087.002","id":"T1087.002","name":"Domain Account","page":"techniques/enterprise/T1087.002/"}],"data_path":"data/detection-rules/968eef52-9cff-4454-8992-1e74b9cbad6c.json","kind":"sigma"}