detection.wiki

Detection rules › Sigma

Domain group enumeration

Status
experimental
Severity
high
Time window
15m
Log source
product windows, service security
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker enumerates domain group with tools like CME (--groups).

MITRE ATT&CK coverage

TacticTechniques
DiscoveryT1069.002 Permission Groups Discovery: Domain Groups, T1087.002 Account Discovery: Domain Account

Event coverage

ProviderEventTitle
Security-AuditingEvent ID 4662An operation was performed on an object.

Rule body yaml

title: Domain group enumeration
description: Detects scenarios where an attacker enumerates domain group with tools like CME (--groups).
correlation: correlate TargetLogonId from ID 4624 with SubjectLogonId from ID 4661 to identify the source of the enumeration.
requirements: extended rights auditing enabled (https://www.manageengine.com/products/active-directory-audit/active-directory-auditing-configuration-guide-configure-object-level-auditing-manually.html)
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0007-Discovery/T1069-Permission%20Groups%20Discovery
- https://hideandsec.sh/books/cheatsheets/page/crackmapexec
- https://www.infosecmatter.com/crackmapexec-module-library/
- https://docs.microsoft.com/en-us/windows/win32/adschema/extended-rights
tags:
- attack.discovery
- attack.t1069.002
- attack.t1087.002
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4662
    ObjectType|contains: '{bf967a9c-0de6-11d0-a285-00aa003049e2}' # Groups class
    ObjectServer: DS
    OperationType: Object Access
  filter:
    SubjectUserName|endswith: '$'
  condition: selection and not filter | count(ObjectName) by Computer > 30 # Count how many different ObjectName (GUID of the group) were enumerated.
  timeframe: 15m
falsepositives:
- Administrator activity
level: high

Stages and Predicates

Stage 0: condition

selection and not filter | count(ObjectName) by Computer > 30 # Count how many different ObjectName (GUID of the group) were enumerated.

Stage 1: selection

selection:
  EventID: 4662
  ObjectType|contains: '{bf967a9c-0de6-11d0-a285-00aa003049e2}'
  ObjectServer: DS
  OperationType: Object Access
Threshold
> 30

Stage 2: not filter

filter:
  SubjectUserName|endswith: '$'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
SubjectUserNameends_with$

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ObjectServereq
  • DS corpus 5 (sigma 3, kusto 2)
ObjectTypematch
  • {bf967a9c-0de6-11d0-a285-00aa003049e2}
OperationTypeeq
  • Object Access corpus 2 (sigma 1, kusto 1)