detection.wiki

Detection rules › Sigma

Reconnaissance Activity

Status
test
Severity
high
Log source
product windows, service security
Author
Florian Roth (Nextron Systems), Jack Croock (method), Jonhnathan Ribeiro (improvements), oscd.community
Source
github.com/SigmaHQ/sigma

Detects activity as "net user administrator /domain" and "net group domain admins /domain"

MITRE ATT&CK coverage

TacticTechniques
DiscoveryT1069.002 Permission Groups Discovery: Domain Groups, T1087.002 Account Discovery: Domain Account

Event coverage

ProviderEventTitle
Security-AuditingEvent ID 4661A handle to an object was requested.

Rule body yaml

title: Reconnaissance Activity
id: 968eef52-9cff-4454-8992-1e74b9cbad6c
status: test
description: Detects activity as "net user administrator /domain" and "net group domain admins /domain"
references:
    - https://findingbad.blogspot.de/2017/01/hunting-what-does-it-look-like.html
author: Florian Roth (Nextron Systems), Jack Croock (method), Jonhnathan Ribeiro (improvements), oscd.community
date: 2017-03-07
modified: 2022-08-22
tags:
    - attack.discovery
    - attack.t1087.002
    - attack.t1069.002
    - attack.s0039
logsource:
    product: windows
    service: security
    definition: The volume of Event ID 4661 is high on Domain Controllers and therefore "Audit SAM" and "Audit Kernel Object" advanced audit policy settings are not configured in the recommendations for server systems
detection:
    selection:
        EventID: 4661
        AccessMask: '0x2d'
        ObjectType:
            - 'SAM_USER'
            - 'SAM_GROUP'
        ObjectName|startswith: 'S-1-5-21-'
        ObjectName|endswith:
            - '-500'
            - '-512'
    condition: selection
falsepositives:
    - Administrator activity
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    EventID: 4661
    AccessMask: '0x2d'
    ObjectType:
        - 'SAM_USER'
        - 'SAM_GROUP'
    ObjectName|startswith: 'S-1-5-21-'
    ObjectName|endswith:
        - '-500'
        - '-512'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
AccessMaskeq
  • 0x2d
ObjectNameends_with
  • -500 corpus 3 (sigma 3)
  • -512 corpus 3 (sigma 3)
ObjectNamestarts_with
  • S-1-5-21- corpus 5 (sigma 5)
ObjectTypeeq
  • SAM_GROUP corpus 4 (sigma 4)
  • SAM_USER corpus 5 (sigma 5)