AD Privileged Users or Groups Reconnaissance

Status: test
Severity: high
Log source: product windows, service security
Author: Samir Bousseaden
Source: github.com/SigmaHQ/sigma

Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs

Known false positives

If source account name is not an admin then its super suspicious

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1087.002` Account Discovery: Domain Account

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4661: A handle to an object was requested.

Rule body

title: AD Privileged Users or Groups Reconnaissance
id: 35ba1d85-724d-42a3-889f-2e2362bcaf23
status: test
description: Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs
references:
    - https://web.archive.org/web/20230329163438/https://blog.menasec.net/2019/02/threat-hunting-5-detecting-enumeration.html
author: Samir Bousseaden
date: 2019-04-03
modified: 2022-07-13
tags:
    - attack.discovery
    - attack.t1087.002
logsource:
    product: windows
    service: security
    definition: 'Requirements: enable Object Access SAM on your Domain Controllers'
detection:
    selection:
        EventID: 4661
        ObjectType:
            - 'SAM_USER'
            - 'SAM_GROUP'
    selection_object:
        - ObjectName|endswith:
              - '-512'
              - '-502'
              - '-500'
              - '-505'
              - '-519'
              - '-520'
              - '-544'
              - '-551'
              - '-555'
        - ObjectName|contains: 'admin'
    filter:
        SubjectUserName|endswith: '$'
    condition: selection and selection_object and not filter
falsepositives:
    - If source account name is not an admin then its super suspicious
level: high

Stages and Predicates

Stage 0: `condition`

selection and selection_object and not filter

Stage 1: `selection`

selection:
    EventID: 4661
    ObjectType:
        - 'SAM_USER'
        - 'SAM_GROUP'

Stage 2: `selection_object`

selection_object:
    - ObjectName|endswith:
          - '-512'
          - '-502'
          - '-500'
          - '-505'
          - '-519'
          - '-520'
          - '-544'
          - '-551'
          - '-555'
    - ObjectName|contains: 'admin'

Stage 3: `not filter`

filter:
    SubjectUserName|endswith: '$'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`SubjectUserName`	ends_with	`$`	`excludes:SubjectUserName` `field:"SubjectUserName" value:"$"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ObjectName`	ends_with	`-500` corpus 3 (sigma 3) `-502` `-505` `-512` corpus 3 (sigma 3) `-519` `-520` `-544` `-551` `-555`	`field:"ObjectName" kind:ends_with`
`ObjectName`	match	`admin`	`field:"ObjectName" kind:match value:"admin"`
`ObjectType`	eq	`SAM_GROUP` corpus 4 (sigma 4) `SAM_USER` corpus 5 (sigma 5)	`field:"ObjectType" kind:eq`

AD Privileged Users or Groups Reconnaissance

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Stage 2: selection_object

Stage 3: not filter

Exclusions

Indicators

Stage 0: `condition`

Stage 1: `selection`

Stage 2: `selection_object`

Stage 3: `not filter`