Detectionmediumtest

Standard User In High Privileged Group

Detect standard users login that are part of high privileged groups such as the Administrator group

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

François HubautCreated Fri Jan 13Updated Fri May 057ac407cc-0f48-4328-aede-de1d2e6fef41windows

Log Source

Windowslsa-server

ProductWindows← raw: windows

Servicelsa-server← raw: lsa-server

Definition

Requirements: Microsoft-Windows-LSA/Operational (199FE037-2B82-40A9-82AC-E1D46C792B99) Event Log must be enabled and collected in order to use this rule.

Detection Logic

detection:
    selection:
        EventID: 300
        TargetUserSid|startswith: 'S-1-5-21-' # Standard user
        SidList|contains:
            - 'S-1-5-32-544'    # Local admin
            - '-500}'           # Domain admin
            - '-518}'           # Schema admin
            - '-519}'           # Enterprise admin
    filter_main_admin:
        TargetUserSid|endswith:
            - '-500'           # Domain admin
            - '-518'           # Schema admin
            - '-519'           # Enterprise admin
    condition: selection and not 1 of filter_main_*

False Positives

Standard domain users who are part of the administrator group. These users shouldn't have these right. But in the case where it's necessary. They should be filtered out using the "TargetUserName" field

References

MITRE ATT&CK

Tactics

TA0006 · Credential Access TA0004 · Privilege Escalation

Rule Metadata

Rule ID