detection.wiki

Detection rules › Sigma

Standard User In High Privileged Group

Status
test
Severity
medium
Log source
product windows, service lsa-server
Author
frack113
Source
github.com/SigmaHQ/sigma

Detect standard users login that are part of high privileged groups such as the Administrator group

Known false positives

  • Standard domain users who are part of the administrator group. These users shouldn't have these right. But in the case where it's necessary. They should be filtered out using the "TargetUserName" field

MITRE ATT&CK coverage

TacticTechniques
Privilege EscalationNo specific technique
Credential AccessNo specific technique

Telemetry coverage

ProviderRecord / event type
LsaSrvEvent ID 300: Groups assigned to a new logon.

Rule body

title: Standard User In High Privileged Group
id: 7ac407cc-0f48-4328-aede-de1d2e6fef41
status: test
description: Detect standard users login that are part of high privileged groups such as the Administrator group
references:
    - https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers
    - https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection
    - https://github.com/nasbench/EVTX-ETW-Resources/blob/7a806a148b3d9d381193d4a80356016e6e8b1ee8/ETWProvidersManifests/Windows11/22H2/W11_22H2_Pro_20221220_22621.963/WEPExplorer/LsaSrv.xml
author: frack113
date: 2023-01-13
modified: 2023-05-05
tags:
    - attack.credential-access
    - attack.privilege-escalation
logsource:
    product: windows
    service: lsa-server
    definition: 'Requirements: Microsoft-Windows-LSA/Operational (199FE037-2B82-40A9-82AC-E1D46C792B99) Event Log must be enabled and collected in order to use this rule.'
detection:
    selection:
        EventID: 300
        TargetUserSid|startswith: 'S-1-5-21-' # Standard user
        SidList|contains:
            - 'S-1-5-32-544'    # Local admin
            - '-500}'           # Domain admin
            - '-518}'           # Schema admin
            - '-519}'           # Enterprise admin
    filter_main_admin:
        TargetUserSid|endswith:
            - '-500'           # Domain admin
            - '-518'           # Schema admin
            - '-519'           # Enterprise admin
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Standard domain users who are part of the administrator group.
      These users shouldn't have these right. But in the case where it's necessary. They should be filtered out using the "TargetUserName" field
level: medium

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_main_*

Stage 1: selection

selection:
    EventID: 300
    TargetUserSid|startswith: 'S-1-5-21-'
    SidList|contains:
        - 'S-1-5-32-544'
        - '-500}'
        - '-518}'
        - '-519}'

Stage 2: not filter_main_admin

filter_main_admin:
    TargetUserSid|endswith:
        - '-500'
        - '-518'
        - '-519'

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
TargetUserSidends_with-500excludes:TargetUserSid field:"TargetUserSid" value:"-500"
TargetUserSidends_with-518excludes:TargetUserSid field:"TargetUserSid" value:"-518"
TargetUserSidends_with-519excludes:TargetUserSid field:"TargetUserSid" value:"-519"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
SidListmatch
  • -500}
  • -518}
  • -519}
  • S-1-5-32-544
field:"SidList" kind:match
TargetUserSidstarts_with
  • S-1-5-21- corpus 3 (sigma 3)
field:"TargetUserSid" kind:starts_with value:"S-1-5-21-"