Detection rules › Sigma
Remote local admin group enumeration via SharpHound
Detects scenarios where an attacker enumerates local administratos group on multiple hosts via SharpHound.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Discovery | T1069.001 Permission Groups Discovery: Local Groups |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4799 | A security-enabled local group membership was enumerated. |
Rule body yaml
title: Remote local admin group enumeration via SharpHound
description: Detects scenarios where an attacker enumerates local administratos group on multiple hosts via SharpHound.
correlation: correlate SubjectLogonId from ID 4799 with TargetLogonId from ID 4624 to identify the source of the enumeration.
requirements: Windows 10 / Server 2016 and higher
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0007-Discovery/T1069-Permission%20Groups%20Discovery
- https://docs.google.com/presentation/d/1OdufXKGYPgoV1d5jDrMYSe-SYKZ7lcA4w2MFn8AkUWE/edit
- https://www.youtube.com/watch?v=_GJDkbUTSLY
- https://community.rsa.com/t5/rsa-netwitness-platform-blog/keeping-an-eye-on-your-hounds/ba-p/519889
- https://bloodhound.readthedocs.io/en/latest/data-collection/sharphound.html
- https://twitter.com/SBousseaden/status/1617856006255673345
tags:
- attack.discovery
- attack.t1069.001 # Permission Groups Discovery: Local Groups
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 4799 # Local group membership enumeration
SubjectUserSid|startswith: 'S-1-5-21-' # Exclude false positives like local system accounts (eg: S-1-5-19 for Local Service)
TargetSid:
- 'S-1-5-32-544' # Administrators
- 'S-1-5-32-555' # Remote Desktop Users
- 'S-1-5-32-580' # Remote Management Users
CallerProcessName: '-' # Process is empty when call is done remotely. Process ID can also be used for the same purpose when it equals to '0x0'.
filter:
SubjectUserName|endswith: '$'
condition: selection and not filter | count(Computer) by SubjectUserSid > 20 # Count on how many hosts this event was produced.
falsepositives:
- Administrators
- Azure Advanced Threat Protection (ATP) sensor
level: medium
Stages and Predicates
Stage 0: condition
selection and not filter | count(Computer) by SubjectUserSid > 20 # Count on how many hosts this event was produced.Stage 1: selection
selection:
EventID: 4799
SubjectUserSid|startswith: 'S-1-5-21-'
TargetSid:
- 'S-1-5-32-544'
- 'S-1-5-32-555'
- 'S-1-5-32-580'
CallerProcessName: '-'
Stage 2: not filter
filter:
SubjectUserName|endswith: '$'
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
SubjectUserName | ends_with | $ |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
CallerProcessName | eq |
|
SubjectUserSid | starts_with |
|
TargetSid | eq |
|