title: Reconnaissance Activity
id: 968eef52-9cff-4454-8992-1e74b9cbad6c
status: test
description: Detects activity as "net user administrator /domain" and "net group domain admins /domain"
author: Florian Roth (rule), Jack Croock (method), Jonhnathan Ribeiro (improvements), oscd.community
references:
  - https://findingbad.blogspot.de/2017/01/hunting-what-does-it-look-like.html
date: 2017/03/07
modified: 2021/11/27
logsource:
  product: windows
  service: security
  definition: The volume of Event ID 4661 is high on Domain Controllers and therefore "Audit SAM" and "Audit Kernel Object" advanced audit policy settings are not configured in the recommendations for server systems
detection:
  selection:
    EventID: 4661
    ObjectType:
      - 'SAM_USER'
      - 'SAM_GROUP'
    ObjectName|startswith: 'S-1-5-21-'
    AccessMask: '0x2d'
  selection2:
    ObjectName|endswith:
      - '-500'
      - '-512'
  condition: selection and selection2
falsepositives:
  - Administrator activity
level: high
tags:
  - attack.discovery
  - attack.t1087.002
  - attack.t1069.002
  - attack.s0039
