Sensitive SAM domain user & groups discovery (native)

Status: experimental
Severity: high
Log source: product windows, service security
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to enumerate sensitive domain group settings and membership.

Known false positives

Administrator activity

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1069.002` Permission Groups Discovery: Domain Groups

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4661: A handle to an object was requested.

Rule body

title: Sensitive SAM domain user & groups discovery (native)
description: Detects scenarios where an attacker attempts to enumerate sensitive domain group settings and membership.
correlation: correlate TargetLogonId from ID 4624 with SubjectLogonId from ID 4661 to identify the source of the enumeration.
requirements: extended rights auditing enabled (https://www.manageengine.com/products/active-directory-audit/active-directory-auditing-configuration-guide-configure-object-level-auditing-manually.html)
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0007-Discovery/T1069-Permission%20Groups%20Discovery
- https://bitvijays.github.io/LFF-IPS-P3-Exploitation.html
tags:
- attack.discovery
- attack.t1069.002
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4661
    ProcessName|endswith: '\lsass.exe'
    ObjectServer: 'Security Account Manager'
    ObjectName|startswith:
      - S-1-5-32- # refers to builtin domain local groups
      - S-1-5-21- # refers to domain users andgroups
    ObjectType:
      - SAM_USER
      - SAM_GROUP
    ObjectName|endswith:
      - '-500' # local administrator / "net user administrator /domain"
      - '-512' # Domain Admins       / "net group "Domain Admins" /domain"
      - '-513' # Domain users
  filter:
    SubjectUserName|endswith: '$'
  condition: selection and not filter
falsepositives:
- Administrator activity
level: high

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
  EventID: 4661
  ProcessName|endswith: '\lsass.exe'
  ObjectServer: 'Security Account Manager'
  ObjectName|startswith:
    - S-1-5-32-
    - S-1-5-21-
  ObjectType:
    - SAM_USER
    - SAM_GROUP
  ObjectName|endswith:
    - '-500'
    - '-512'
    - '-513'

Stage 2: `not filter`

filter:
  SubjectUserName|endswith: '$'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`SubjectUserName`	ends_with	`$`	`excludes:SubjectUserName` `field:"SubjectUserName" value:"$"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ObjectName`	ends_with	`-500` corpus 3 (sigma 3) `-512` corpus 3 (sigma 3) `-513`	`field:"ObjectName" kind:ends_with`
`ObjectName`	starts_with	`S-1-5-21-` corpus 5 (sigma 5) `S-1-5-32-` corpus 3 (sigma 3)	`field:"ObjectName" kind:starts_with`
`ObjectServer`	eq	`Security Account Manager` corpus 7 (sigma 7)	`field:"ObjectServer" kind:eq value:"Security Account Manager"`
`ObjectType`	eq	`SAM_GROUP` corpus 4 (sigma 4) `SAM_USER` corpus 5 (sigma 5)	`field:"ObjectType" kind:eq`
`ProcessName`	ends_with	`\lsass.exe` corpus 7 (sigma 7)	`field:"process_name" kind:ends_with value:"\lsass.exe"`