Windows LSA event: Standard user SID in privileged AD groups (EventID 300)

title: "Windows LSA event: Standard user SID in privileged AD groups (EventID 300)"
id: c92698ea-e5f6-4a1d-8c24-3cbadf1b3c2c
status: test
description: This rule flags LSA operational events where a target account with a standard user SID prefix is associated with high-privilege group identifiers (local admin or various admin groups) within the SID list. Such events matter because attackers often gain privilege by adding themselves or compromised accounts to privileged groups, including local or domain-level administrators. The detection relies on Windows LSA-Server telemetry for EventID 300 and matches on TargetUserSid plus specific group-related SID values in SidList, excluding cases where TargetUserSid ends with specific domain/schema/enterprise admin patterns.
references:
  - https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers
  - https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection
  - https://github.com/nasbench/EVTX-ETW-Resources/blob/7a806a148b3d9d381193d4a80356016e6e8b1ee8/ETWProvidersManifests/Windows11/22H2/W11_22H2_Pro_20221220_22621.963/WEPExplorer/LsaSrv.xml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/lsa_server/win_lsa_server_normal_user_admin.yml
author: frack113, Huntrule Team
date: 2023-01-13
modified: 2023-05-05
tags:
  - attack.credential-access
  - attack.privilege-escalation
logsource:
  product: windows
  service: lsa-server
  definition: "Requirements: Microsoft-Windows-LSA/Operational (199FE037-2B82-40A9-82AC-E1D46C792B99) Event Log must be enabled and collected in order to use this rule."
detection:
  selection:
    EventID: 300
    TargetUserSid|startswith: S-1-5-21-
    SidList|contains:
      - S-1-5-32-544
      - -500}
      - -518}
      - -519}
  filter_main_admin:
    TargetUserSid|endswith:
      - "-500"
      - "-518"
      - "-519"
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Standard domain users who are part of the administrator group. These users shouldn't have these right. But in the case where it's necessary. They should be filtered out using the "TargetUserName" field
level: medium
license: DRL-1.1
related:
  - id: 7ac407cc-0f48-4328-aede-de1d2e6fef41
    type: derived