Detection rules › Sigma
Lateral movement detection (based on "special groups" feature)
Detects scenarios where a user of a predefined set of group(s) logs on a target machine.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1078 Valid Accounts |
| Lateral Movement | T1021.002 Remote Services: SMB/Windows Admin Shares |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4964 | Special groups have been assigned to a new logon. |
Rule body yaml
title: Lateral movement detection (based on "special groups" feature)
description: Detects scenarios where a user of a predefined set of group(s) logs on a target machine.
requirements: registry configuration has to be pushed per GPO to specify the groups to be monitored. See links below for more detailed information.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1078.002-Valid%20accounts-Domain%20accounts
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4964
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4908
- https://docs.microsoft.com/fr-fr/archive/blogs/jepayne/tracking-lateral-movement-part-one-special-groups-and-specific-service-accounts
- https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/special-groups-auditing-via-group-policy-preferences/ba-p/395095
- https://i.blackhat.com/us-18/Wed-August-8/us-18-Metcalf-From-Workstation-To-Domain-Admin-Why-Secure-Administration-Isnt-Secure.pdf
tags:
- attack.defense_evasion
- attack.t1078
- attack.lateral_movement
- attack.t1021.002
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 4964
condition: selection
falsepositives:
- Normal activity of a user member of a monitored group
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
EventID: 4964