Windows LSA Event 300: Standard user added to privileged groups (Administrator/AdminSD/Domain Admin SIDs)

title: "Windows LSA Event 300: Standard user added to privileged groups (Administrator/AdminSD/Domain Admin SIDs)"
id: c92698ea-e5f6-4a1d-8c24-3cbadf1b3c2c
status: test
description: This rule flags Windows LSA operational activity where the TargetUserSid appears to be a standard user and the session involves membership in high-privileged group SIDs. Attackers often seek privileged group access to enable credential access and privilege escalation, so unusual standard-user inclusion in these groups can indicate misconfiguration or abuse. The detection relies on LSA operational EventID 300 telemetry containing TargetUserSid and SidList values, including specific built-in and domain/forest privileged group SID patterns.
references:
  - https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers
  - https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection
  - https://github.com/nasbench/EVTX-ETW-Resources/blob/7a806a148b3d9d381193d4a80356016e6e8b1ee8/ETWProvidersManifests/Windows11/22H2/W11_22H2_Pro_20221220_22621.963/WEPExplorer/LsaSrv.xml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/lsa_server/win_lsa_server_normal_user_admin.yml
author: frack113, Huntrule Team
date: 2023-01-13
modified: 2023-05-05
tags:
  - attack.credential-access
  - attack.privilege-escalation
logsource:
  product: windows
  service: lsa-server
  definition: "Requirements: Microsoft-Windows-LSA/Operational (199FE037-2B82-40A9-82AC-E1D46C792B99) Event Log must be enabled and collected in order to use this rule."
detection:
  selection:
    EventID: 300
    TargetUserSid|startswith: S-1-5-21-
    SidList|contains:
      - S-1-5-32-544
      - -500}
      - -518}
      - -519}
  filter_main_admin:
    TargetUserSid|endswith:
      - "-500"
      - "-518"
      - "-519"
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Standard domain users who are part of the administrator group. These users shouldn't have these right. But in the case where it's necessary. They should be filtered out using the "TargetUserName" field
level: medium
license: DRL-1.1
related:
  - id: 7ac407cc-0f48-4328-aede-de1d2e6fef41
    type: derived