
title: AD Privileged Users or Groups Reconnaissance
author: Samir Bousseaden
date: 2019/04/03
description: Detect priv users or groups recon based on 4661 eventid and known privileged
  users or groups SIDs
detection:
  SELECTION_1:
    EventID: 4661
  SELECTION_2:
    ObjectType:
    - SAM_USER
    - SAM_GROUP
  SELECTION_3:
    ObjectName:
    - '*-512'
    - '*-502'
    - '*-500'
    - '*-505'
    - '*-519'
    - '*-520'
    - '*-544'
    - '*-551'
    - '*-555'
  SELECTION_4:
    ObjectName: '*admin*'
  condition: ((SELECTION_1 and SELECTION_2) and (SELECTION_3 or SELECTION_4))
falsepositives:
- if source account name is not an admin then its super suspicious
id: 35ba1d85-724d-42a3-889f-2e2362bcaf23
level: high
logsource:
  definition: 'Requirements: enable Object Access SAM on your Domain Controllers'
  product: windows
  service: security
modified: 2021/09/08
references:
- https://blog.menasec.net/2019/02/threat-hunting-5-detecting-enumeration.html
status: experimental
tags:
- attack.discovery
- attack.t1087
- attack.t1087.002
ruletype: SIGMA
