Detection rules › Splunk

Windows AD Privileged Object Access Activity

Author
Steven Dick
Source
upstream

The following analytic detects access attempts to privileged Active Directory objects, such as Domain Admins or Enterprise Admins. It leverages Windows Security Event Code 4662 to identify when these sensitive objects are accessed. This activity is significant because such objects should rarely be accessed by normal users or processes, and unauthorized access attempts may indicate attacker enumeration or lateral movement within the domain. If confirmed malicious, this activity could allow attackers to escalate privileges, persist in the environment, or gain control over critical domain resources.

MITRE ATT&CK coverage

TacticTechniques
DiscoveryT1087.002 Account Discovery: Domain Account

Event coverage

ProviderEvent IDTitle
Security-Auditing4662An operation was performed on an object.

Stages and Predicates

Stage 1: search

search EventCode=4662 ObjectName IN ("CN=Account Operators,*", "CN=Administrators,*", "CN=Backup Operators,*", "CN=Cert Publishers,*", "CN=Certificate Service DCOM Access,*", "CN=Domain Admins,*", "CN=Domain Controllers,*", "CN=Enterprise Admins,*", "CN=Enterprise Read-only Domain Controllers,*", "CN=Exchange Trusted Subsystem,*", "CN=Exchange Windows Permission,*", "CN=Group Policy Creator Owners,*", "CN=Incoming Forest Trust Builders,*", "CN=Microsoft Exchange Servers,*", "CN=Network Configuration Operators,*", "CN=Organization Management,*", "CN=Power Users,*", "CN=Print Operators,*", "CN=Read-only Domain Controllers,*", "CN=Replicators,*", "CN=Schema Admins,*", "CN=Server Operators,*")

Stage 2: rex

rex field=ObjectName ...

Stage 3: stats

stats BY SubjectUserName

Stage 4: rename

rename

Stage 5: search

search

Stage 6: search

search

Stage 7: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventCodeeq
  • 4662 corpus 4 (splunk 4)
ObjectNamein
  • "CN=Account Operators,*"
  • "CN=Administrators,*"
  • "CN=Backup Operators,*"
  • "CN=Cert Publishers,*"
  • "CN=Certificate Service DCOM Access,*"
  • "CN=Domain Admins,*"
  • "CN=Domain Controllers,*"
  • "CN=Enterprise Admins,*"
  • "CN=Enterprise Read-only Domain Controllers,*"
  • "CN=Exchange Trusted Subsystem,*"
  • "CN=Exchange Windows Permission,*"
  • "CN=Group Policy Creator Owners,*"
  • "CN=Incoming Forest Trust Builders,*"
  • "CN=Microsoft Exchange Servers,*"
  • "CN=Network Configuration Operators,*"
  • "CN=Organization Management,*"
  • "CN=Power Users,*"
  • "CN=Print Operators,*"
  • "CN=Read-only Domain Controllers,*"
  • "CN=Replicators,*"
  • "CN=Schema Admins,*"
  • "CN=Server Operators,*"

Neighbors

Broader alternatives (more inclusive than this rule)

These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.