detection.wiki

Detection rules › Sigma

Standard User In High Privileged Group

Status
test
Severity
medium
Log source
product windows, service lsa-server
Author
frack113
Source
github.com/SigmaHQ/sigma

Detect standard users login that are part of high privileged groups such as the Administrator group

MITRE ATT&CK coverage

TacticTechniques
Privilege EscalationNo specific technique
Credential AccessNo specific technique

Event coverage

ProviderEventTitle
LsaSrvEvent ID 300Groups assigned to a new logon.

Rule body yaml

title: Standard User In High Privileged Group
id: 7ac407cc-0f48-4328-aede-de1d2e6fef41
status: test
description: Detect standard users login that are part of high privileged groups such as the Administrator group
references:
    - https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers
    - https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection
    - https://github.com/nasbench/EVTX-ETW-Resources/blob/7a806a148b3d9d381193d4a80356016e6e8b1ee8/ETWProvidersManifests/Windows11/22H2/W11_22H2_Pro_20221220_22621.963/WEPExplorer/LsaSrv.xml
author: frack113
date: 2023-01-13
modified: 2023-05-05
tags:
    - attack.credential-access
    - attack.privilege-escalation
logsource:
    product: windows
    service: lsa-server
    definition: 'Requirements: Microsoft-Windows-LSA/Operational (199FE037-2B82-40A9-82AC-E1D46C792B99) Event Log must be enabled and collected in order to use this rule.'
detection:
    selection:
        EventID: 300
        TargetUserSid|startswith: 'S-1-5-21-' # Standard user
        SidList|contains:
            - 'S-1-5-32-544'    # Local admin
            - '-500}'           # Domain admin
            - '-518}'           # Schema admin
            - '-519}'           # Enterprise admin
    filter_main_admin:
        TargetUserSid|endswith:
            - '-500'           # Domain admin
            - '-518'           # Schema admin
            - '-519'           # Enterprise admin
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Standard domain users who are part of the administrator group.
      These users shouldn't have these right. But in the case where it's necessary. They should be filtered out using the "TargetUserName" field
level: medium

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_main_*

Stage 1: selection

selection:
    EventID: 300
    TargetUserSid|startswith: 'S-1-5-21-'
    SidList|contains:
        - 'S-1-5-32-544'
        - '-500}'
        - '-518}'
        - '-519}'

Stage 2: not filter_main_admin

filter_main_admin:
    TargetUserSid|endswith:
        - '-500'
        - '-518'
        - '-519'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
TargetUserSidends_with-500
TargetUserSidends_with-518
TargetUserSidends_with-519

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
SidListmatch
  • -500}
  • -518}
  • -519}
  • S-1-5-32-544
TargetUserSidstarts_with
  • S-1-5-21- corpus 3 (sigma 3)