Reconnaissance Activity

Status: test
Severity: high
Log source: product windows, service security
Author: Florian Roth (Nextron Systems), Jack Croock (method), Jonhnathan Ribeiro (improvements), oscd.community
Source: github.com/SigmaHQ/sigma

Detects activity as "net user administrator /domain" and "net group domain admins /domain"

Known false positives

Administrator activity

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1069.002` Permission Groups Discovery: Domain Groups `T1087.002` Account Discovery: Domain Account

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4661: A handle to an object was requested.

Rule body

title: Reconnaissance Activity
id: 968eef52-9cff-4454-8992-1e74b9cbad6c
status: test
description: Detects activity as "net user administrator /domain" and "net group domain admins /domain"
references:
    - https://findingbad.blogspot.de/2017/01/hunting-what-does-it-look-like.html
author: Florian Roth (Nextron Systems), Jack Croock (method), Jonhnathan Ribeiro (improvements), oscd.community
date: 2017-03-07
modified: 2022-08-22
tags:
    - attack.discovery
    - attack.t1087.002
    - attack.t1069.002
    - attack.s0039
logsource:
    product: windows
    service: security
    definition: The volume of Event ID 4661 is high on Domain Controllers and therefore "Audit SAM" and "Audit Kernel Object" advanced audit policy settings are not configured in the recommendations for server systems
detection:
    selection:
        EventID: 4661
        AccessMask: '0x2d'
        ObjectType:
            - 'SAM_USER'
            - 'SAM_GROUP'
        ObjectName|startswith: 'S-1-5-21-'
        ObjectName|endswith:
            - '-500'
            - '-512'
    condition: selection
falsepositives:
    - Administrator activity
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    EventID: 4661
    AccessMask: '0x2d'
    ObjectType:
        - 'SAM_USER'
        - 'SAM_GROUP'
    ObjectName|startswith: 'S-1-5-21-'
    ObjectName|endswith:
        - '-500'
        - '-512'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AccessMask`	eq	`0x2d`	`field:"AccessMask" kind:eq value:"0x2d"`
`ObjectName`	ends_with	`-500` corpus 3 (sigma 3) `-512` corpus 3 (sigma 3)	`field:"ObjectName" kind:ends_with`
`ObjectName`	starts_with	`S-1-5-21-` corpus 5 (sigma 5)	`field:"ObjectName" kind:starts_with value:"S-1-5-21-"`
`ObjectType`	eq	`SAM_GROUP` corpus 4 (sigma 4) `SAM_USER` corpus 5 (sigma 5)	`field:"ObjectType" kind:eq`

Reconnaissance Activity

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Stage 0: `condition`

Stage 1: `selection`