{"id":"ab6bffca-beff-4baa-af11-6733f296d57a","title":"Potential AD User Enumeration From Non-Machine Account","description":"Detects read access to a domain user from a non-machine account","author":"Maxime Thiebaut (@0xThiebaut)","status":"test","level":"medium","date":"2020-03-30","modified":"2022-11-08","tags":["attack.discovery","attack.t1087.002"],"technique_ids":["T1087.002"],"logsource":{"product":"windows","service":"security","definition":"Requirements: The \"Read all properties\" permission on the user object needs to be audited for the \"Everyone\" principal"},"falsepositives":["Administrators configuring new users."],"references":["https://www.specterops.io/assets/resources/an_ace_up_the_sleeve.pdf","http://www.stuffithoughtiknew.com/2019/02/detecting-bloodhound.html","https://learn.microsoft.com/en-us/windows/win32/adschema/attributes-all","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4662"],"source_path":"rules/windows/builtin/security/win_security_ad_user_enumeration.yml","source_sha256":"139643866be256cdfb2aa3f01173c5f71fa7cbfd6a47873f1f65ade6e3e9e005","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_ad_user_enumeration.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential AD User Enumeration From Non-Machine Account\nid: ab6bffca-beff-4baa-af11-6733f296d57a\nstatus: test\ndescription: Detects read access to a domain user from a non-machine account\nreferences:\n    - https://www.specterops.io/assets/resources/an_ace_up_the_sleeve.pdf\n    - http://www.stuffithoughtiknew.com/2019/02/detecting-bloodhound.html\n    - https://learn.microsoft.com/en-us/windows/win32/adschema/attributes-all # For further investigation of the accessed properties\n    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4662\nauthor: Maxime Thiebaut (@0xThiebaut)\ndate: 2020-03-30\nmodified: 2022-11-08\ntags:\n    - attack.discovery\n    - attack.t1087.002\nlogsource:\n    product: windows\n    service: security\n    definition: 'Requirements: The \"Read all properties\" permission on the user object needs to be audited for the \"Everyone\" principal'\ndetection:\n    selection:\n        EventID: 4662\n        # Using contains as the data commonly is structured as \"%{bf967aba-0de6-11d0-a285-00aa003049e2}\"\n        # The user class (https://learn.microsoft.com/en-us/windows/win32/adschema/c-user)\n        ObjectType|contains: 'bf967aba-0de6-11d0-a285-00aa003049e2'\n        AccessMask|endswith:\n            # Note: Since the Access Mask can have more than once permission we need to add all permutations that include the READ property\n            - '1?' # This covers all access masks that are 1 bytes or shorter and the \"Read Property\" itself\n            - '3?' # Read Property + Write Property\n            - '4?' # Read Property + Delete Tree\n            - '7?' # Read Property + Write Property + Delete Tree\n            - '9?' # Read Property + List Object\n            - 'B?' # Read Property + Write Property + List Object\n            - 'D?' # Read Property + Delete Tree + List Object\n            - 'F?' # Covers usage of all possible 2 bytes permissions with any or none of the single byte permissions\n    filter_main_machine_accounts:\n        SubjectUserName|endswith: '$' # Exclude machine accounts\n    filter_main_msql:\n        SubjectUserName|startswith: 'MSOL_' # https://learn.microsoft.com/en-us/azure/active-directory/hybrid/reference-connect-accounts-permissions#ad-ds-connector-account\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Administrators configuring new users.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1087.002","id":"T1087.002","name":"Domain Account","page":"techniques/enterprise/T1087.002/"}],"data_path":"data/detection-rules/ab6bffca-beff-4baa-af11-6733f296d57a.json","kind":"sigma"}