AD Privileged Users or Groups Reconnaissance — Sigma Rule

Rule metadata and linked tags

Author: Samir Bousseaden. Source status: test; severity: high. Source dates: 2019-04-03 / 2022-07-13.

{
  "product": "windows",
  "service": "security",
  "definition": "Requirements: enable Object Access SAM on your Domain Controllers"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: ad85d022b60f700ff984ffbd111f9ba57469bba8b675a79acf3f92c69ad7ea88

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: AD Privileged Users or Groups Reconnaissance
id: 35ba1d85-724d-42a3-889f-2e2362bcaf23
status: test
description: Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs
references:
    - https://web.archive.org/web/20230329163438/https://blog.menasec.net/2019/02/threat-hunting-5-detecting-enumeration.html
author: Samir Bousseaden
date: 2019-04-03
modified: 2022-07-13
tags:
    - attack.discovery
    - attack.t1087.002
logsource:
    product: windows
    service: security
    definition: 'Requirements: enable Object Access SAM on your Domain Controllers'
detection:
    selection:
        EventID: 4661
        ObjectType:
            - 'SAM_USER'
            - 'SAM_GROUP'
    selection_object:
        - ObjectName|endswith:
              - '-512'
              - '-502'
              - '-500'
              - '-505'
              - '-519'
              - '-520'
              - '-544'
              - '-551'
              - '-555'
        - ObjectName|contains: 'admin'
    filter:
        SubjectUserName|endswith: '$'
    condition: selection and selection_object and not filter
falsepositives:
    - If source account name is not an admin then its super suspicious
level: high

Original YAML and metadata in JSON

False positives

• If source account name is not an admin then its super suspicious

Source references

• https://web.archive.org/web/20230329163438/https://blog.menasec.net/2019/02/threat-hunting-5-detecting-enumeration.html