Windows Security 4662 Detects AD User Object Property Reads from Non-Machine Accounts

Alert on AD user property read attempts in Windows Event 4662 from non-machine accounts.

FreeUnreviewedSigmamediumv1

windows-security-4662-detects-ad-user-object-property-reads-from-non-machine-acc-ab6bffca

title: Windows Security 4662 Detects AD User Object Property Reads from Non-Machine Accounts
id: 7ca11e36-b098-40c2-8579-90a3e3c4dd72
status: test
description: This rule flags Windows Security Event ID 4662 access where the target Active Directory object type corresponds to an AD user and the granted access mask includes read-property related permissions. It focuses on activity from non-machine accounts by excluding machine accounts (ending with '$') and excluding certain MSOL_ connector accounts. This matters because attackers performing reconnaissance may read user attributes to enumerate accounts or validate targets, and the detection relies on object-access auditing telemetry from Event ID 4662 that includes ObjectType, AccessMask, and SubjectUserName.
references:
  - https://www.specterops.io/assets/resources/an_ace_up_the_sleeve.pdf
  - http://www.stuffithoughtiknew.com/2019/02/detecting-bloodhound.html
  - https://learn.microsoft.com/en-us/windows/win32/adschema/attributes-all
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4662
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_ad_user_enumeration.yml
author: Maxime Thiebaut (@0xThiebaut), Huntrule Team
date: 2020-03-30
modified: 2022-11-08
tags:
  - attack.discovery
  - attack.t1087.002
logsource:
  product: windows
  service: security
  definition: 'Requirements: The "Read all properties" permission on the user object needs to be audited for the "Everyone" principal'
detection:
  selection:
    EventID: 4662
    ObjectType|contains: bf967aba-0de6-11d0-a285-00aa003049e2
    AccessMask|endswith:
      - 1?
      - 3?
      - 4?
      - 7?
      - 9?
      - B?
      - D?
      - F?
  filter_main_machine_accounts:
    SubjectUserName|endswith: $
  filter_main_msql:
    SubjectUserName|startswith: MSOL_
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Administrators configuring new users.
level: medium
license: DRL-1.1
related:
  - id: ab6bffca-beff-4baa-af11-6733f296d57a
    type: derived

What it detects

This rule flags Windows Security Event ID 4662 access where the target Active Directory object type corresponds to an AD user and the granted access mask includes read-property related permissions. It focuses on activity from non-machine accounts by excluding machine accounts (ending with '$') and excluding certain MSOL_ connector accounts. This matters because attackers performing reconnaissance may read user attributes to enumerate accounts or validate targets, and the detection relies on object-access auditing telemetry from Event ID 4662 that includes ObjectType, AccessMask, and SubjectUserName.

Known false positives

Administrators configuring new users.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.