
title: Reconnaissance Activity
author: Florian Roth (rule), Jack Croock (method), Jonhnathan Ribeiro (improvements),
  oscd.community
date: 2017/03/07
description: Detects activity as "net user administrator /domain" and "net group domain
  admins /domain"
detection:
  SELECTION_1:
    EventID: 4661
  SELECTION_2:
    ObjectType:
    - SAM_USER
    - SAM_GROUP
  SELECTION_3:
    ObjectName: S-1-5-21-*
  SELECTION_4:
    AccessMask: '0x2d'
  SELECTION_5:
    ObjectName:
    - '*-500'
    - '*-512'
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3 and SELECTION_4 and SELECTION_5)
falsepositives:
- Administrator activity
- Penetration tests
id: 968eef52-9cff-4454-8992-1e74b9cbad6c
level: high
logsource:
  definition: The volume of Event ID 4661 is high on Domain Controllers and therefore
    "Audit SAM" and "Audit Kernel Object" advanced audit policy settings are not configured
    in the recommendations for server systems
  product: windows
  service: security
modified: 2020/08/23
references:
- https://findingbad.blogspot.de/2017/01/hunting-what-does-it-look-like.html
status: experimental
tags:
- attack.discovery
- attack.t1087
- attack.t1087.002
- attack.t1069
- attack.t1069.002
- attack.s0039
ruletype: SIGMA
