Detection rules › Sigma
Domain group enumeration
Detects scenarios where an attacker enumerates domain group with tools like CME (--groups).
Known false positives
- Administrator activity
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Discovery |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 4662: An operation was performed on an object. |
Rule body
title: Domain group enumeration
description: Detects scenarios where an attacker enumerates domain group with tools like CME (--groups).
correlation: correlate TargetLogonId from ID 4624 with SubjectLogonId from ID 4661 to identify the source of the enumeration.
requirements: extended rights auditing enabled (https://www.manageengine.com/products/active-directory-audit/active-directory-auditing-configuration-guide-configure-object-level-auditing-manually.html)
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0007-Discovery/T1069-Permission%20Groups%20Discovery
- https://hideandsec.sh/books/cheatsheets/page/crackmapexec
- https://www.infosecmatter.com/crackmapexec-module-library/
- https://docs.microsoft.com/en-us/windows/win32/adschema/extended-rights
tags:
- attack.discovery
- attack.t1069.002
- attack.t1087.002
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 4662
ObjectType|contains: '{bf967a9c-0de6-11d0-a285-00aa003049e2}' # Groups class
ObjectServer: DS
OperationType: Object Access
filter:
SubjectUserName|endswith: '$'
condition: selection and not filter | count(ObjectName) by Computer > 30 # Count how many different ObjectName (GUID of the group) were enumerated.
timeframe: 15m
falsepositives:
- Administrator activity
level: high
Stages and Predicates
Stage 0: condition
selection and not filter | count(ObjectName) by Computer > 30 # Count how many different ObjectName (GUID of the group) were enumerated.Stage 1: selection
selection:
EventID: 4662
ObjectType|contains: '{bf967a9c-0de6-11d0-a285-00aa003049e2}'
ObjectServer: DS
OperationType: Object Access
Stage 2: not filter
filter:
SubjectUserName|endswith: '$'
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
SubjectUserName | ends_with | $ | excludes:SubjectUserName field:"SubjectUserName" value:"$" |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ObjectServer | eq |
| field:"ObjectServer" kind:eq value:"DS" |
ObjectType | match |
| field:"ObjectType" kind:match value:"{bf967a9c-0de6-11d0-a285-00aa003049e2}" |
OperationType | eq |
| field:"OperationType" kind:eq value:"Object Access" |