Remote local admin group enumeration via SharpHound

Status: experimental
Severity: medium
Log source: product windows, service security
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker enumerates local administratos group on multiple hosts via SharpHound.

Known false positives

Administrators
Azure Advanced Threat Protection (ATP) sensor

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1069.001` Permission Groups Discovery: Local Groups

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4799: A security-enabled local group membership was enumerated.

Rule body

title: Remote local admin group enumeration via SharpHound
description: Detects scenarios where an attacker enumerates local administratos group on multiple hosts via SharpHound.
correlation: correlate SubjectLogonId from ID 4799 with TargetLogonId from ID 4624 to identify the source of the enumeration.
requirements: Windows 10 / Server 2016 and higher
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0007-Discovery/T1069-Permission%20Groups%20Discovery
- https://docs.google.com/presentation/d/1OdufXKGYPgoV1d5jDrMYSe-SYKZ7lcA4w2MFn8AkUWE/edit
- https://www.youtube.com/watch?v=_GJDkbUTSLY
- https://community.rsa.com/t5/rsa-netwitness-platform-blog/keeping-an-eye-on-your-hounds/ba-p/519889
- https://bloodhound.readthedocs.io/en/latest/data-collection/sharphound.html
- https://twitter.com/SBousseaden/status/1617856006255673345
tags:
- attack.discovery
- attack.t1069.001 # Permission Groups Discovery: Local Groups 
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4799 # Local group membership enumeration
    SubjectUserSid|startswith: 'S-1-5-21-' # Exclude false positives like local system accounts (eg: S-1-5-19 for Local Service)
    TargetSid:
      - 'S-1-5-32-544' # Administrators
      - 'S-1-5-32-555' # Remote Desktop Users
      - 'S-1-5-32-580' # Remote Management Users
    CallerProcessName: '-'  # Process is empty when call is done remotely. Process ID can also be used for the same purpose when it equals to '0x0'.
  filter:
    SubjectUserName|endswith: '$'
  condition: selection and not filter | count(Computer) by SubjectUserSid > 20 # Count on how many hosts this event was produced.
falsepositives:
- Administrators
- Azure Advanced Threat Protection (ATP) sensor
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not filter | count(Computer) by SubjectUserSid > 20 # Count on how many hosts this event was produced.

Stage 1: `selection`

selection:
  EventID: 4799
  SubjectUserSid|startswith: 'S-1-5-21-'
  TargetSid:
    - 'S-1-5-32-544'
    - 'S-1-5-32-555'
    - 'S-1-5-32-580'
  CallerProcessName: '-'

Threshold: > 20

Stage 2: `not filter`

filter:
  SubjectUserName|endswith: '$'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`SubjectUserName`	ends_with	`$`	`excludes:SubjectUserName` `field:"SubjectUserName" value:"$"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CallerProcessName`	eq	`-`	`field:"CallerProcessName" kind:eq value:"-"`
`SubjectUserSid`	starts_with	`S-1-5-21-` corpus 5 (sigma 5)	`field:"SubjectUserSid" kind:starts_with value:"S-1-5-21-"`
`TargetSid`	eq	`S-1-5-32-544` corpus 2 (sigma 2) `S-1-5-32-555` `S-1-5-32-580`	`field:"TargetSid" kind:eq`