Windows LSA event: Standard user SID in privileged AD groups (EventID 300)
Alerts when LSA Event 300 shows a standard user interacting with high-privileged group SIDs, excluding common domain admin patterns.
- Product
- windows
- Service
- lsa-server
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2023-01-13
- Updated
- 2026-07-31
What it detects
This rule flags LSA operational events where a target account with a standard user SID prefix is associated with high-privilege group identifiers (local admin or various admin groups) within the SID list. Such events matter because attackers often gain privilege by adding themselves or compromised accounts to privileged groups, including local or domain-level administrators. The detection relies on Windows LSA-Server telemetry for EventID 300 and matches on TargetUserSid plus specific group-related SID values in SidList, excluding cases where TargetUserSid ends with specific domain/schema/enterprise admin patterns.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection
- github.comhttps://github.com/nasbench/EVTX-ETW-Resources/blob/7a806a148b3d9d381193d4a80356016e6e8b1ee8/ETWProvidersManifests/Windows11/22H2/W11_22H2_Pro_20221220_22621.963/WEPExplorer/LsaSrv.xml
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/lsa_server/win_lsa_server_normal_user_admin.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows LSA event: Standard user SID in privileged AD groups (EventID 300)"
id: c92698ea-e5f6-4a1d-8c24-3cbadf1b3c2c
status: test
description: This rule flags LSA operational events where a target account with a standard user SID prefix is associated with high-privilege group identifiers (local admin or various admin groups) within the SID list. Such events matter because attackers often gain privilege by adding themselves or compromised accounts to privileged groups, including local or domain-level administrators. The detection relies on Windows LSA-Server telemetry for EventID 300 and matches on TargetUserSid plus specific group-related SID values in SidList, excluding cases where TargetUserSid ends with specific domain/schema/enterprise admin patterns.
references:
- https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers
- https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection
- https://github.com/nasbench/EVTX-ETW-Resources/blob/7a806a148b3d9d381193d4a80356016e6e8b1ee8/ETWProvidersManifests/Windows11/22H2/W11_22H2_Pro_20221220_22621.963/WEPExplorer/LsaSrv.xml
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/lsa_server/win_lsa_server_normal_user_admin.yml
author: frack113, Huntrule Team
date: 2023-01-13
modified: 2023-05-05
tags:
- attack.credential-access
- attack.privilege-escalation
logsource:
product: windows
service: lsa-server
definition: "Requirements: Microsoft-Windows-LSA/Operational (199FE037-2B82-40A9-82AC-E1D46C792B99) Event Log must be enabled and collected in order to use this rule."
detection:
selection:
EventID: 300
TargetUserSid|startswith: S-1-5-21-
SidList|contains:
- S-1-5-32-544
- -500}
- -518}
- -519}
filter_main_admin:
TargetUserSid|endswith:
- "-500"
- "-518"
- "-519"
condition: selection and not 1 of filter_main_*
falsepositives:
- Standard domain users who are part of the administrator group. These users shouldn't have these right. But in the case where it's necessary. They should be filtered out using the "TargetUserName" field
level: medium
license: DRL-1.1
related:
- id: 7ac407cc-0f48-4328-aede-de1d2e6fef41
type: derived