detection.wiki

Detection rules › Sigma

Reconnaissance Activity

Severity
high
Author
Florian Roth (Nextron Systems), Jack Croock (method), Jonhnathan Ribeiro (improvements), oscd.community
Source
upstream

Detects activity as "net user administrator /domain" and "net group domain admins /domain"

MITRE ATT&CK coverage

TacticTechniques
DiscoveryT1069.002 Permission Groups Discovery: Domain Groups, T1087.002 Account Discovery: Domain Account

Event coverage

ProviderEvent IDTitle
Security-Auditing4661A handle to an object was requested.

Stages and Predicates

Stage 1: selection

or:
ObjectName|endswith: -500
ObjectName|endswith: -512
ObjectType: [SAM_GROUP, SAM_USER]
AccessMask: 0x2d
ObjectName|startswith: S-1-5-21-

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
AccessMaskeq
  • 0x2d
ObjectNameends_with
  • -500 corpus 2 (sigma 2)
  • -512 corpus 2 (sigma 2)
ObjectNamestarts_with
  • S-1-5-21-
ObjectTypeeq
  • SAM_GROUP corpus 2 (sigma 2)
  • SAM_USER corpus 2 (sigma 2)

Neighbors

Broader alternatives (more inclusive than this rule)

These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.