Windows Security 4799: checkadmin.exe Targeting Administrators during Operation Wocao Activity

Detects Windows Security Event 4799 where checkadmin.exe targets “Administr*” accounts, consistent with admin account enumeration.

FreeUnreviewedSigmahighv1

windows-security-4799-checkadmin-exe-targeting-administrators-during-operation-w-74ad4314

title: "Windows Security 4799: checkadmin.exe Targeting Administrators during Operation Wocao Activity"
id: c54e7de0-9c7a-442f-814f-f18cda0d2aca
status: test
description: This rule flags Windows Security events with Event ID 4799 where the TargetUserName starts with “Administr” and the CallerProcessName ends with “\checkadmin.exe”. The matched behavior indicates account/service permission discovery or enumeration activity targeting local administrator accounts, which can be used for reconnaissance or subsequent privilege escalation. It relies on Windows Security auditing telemetry that records the event ID, target account name, and the initiating process path.
references:
  - https://web.archive.org/web/20200226212615/https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/
  - https://web.archive.org/web/20200226212615/https://resources.fox-it.com/rs/170-CAK-271/images/201912_Report_Operation_Wocao.pdf
  - https://twitter.com/SBousseaden/status/1207671369963646976
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/TA/Operation-Wocao/win_security_apt_wocao.yml
author: Florian Roth (Nextron Systems), frack113, Huntrule Team
date: 2019-12-20
modified: 2022-11-27
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.discovery
  - attack.stealth
  - attack.t1012
  - attack.t1036.004
  - attack.t1027
  - attack.execution
  - attack.t1053.005
  - attack.t1059.001
  - detection.emerging-threats
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4799
    TargetUserName|startswith: Administr
    CallerProcessName|endswith: \checkadmin.exe
  condition: selection
falsepositives:
  - Administrators that use checkadmin.exe tool to enumerate local administrators
level: high
license: DRL-1.1
related:
  - id: 74ad4314-482e-4c3e-b237-3f7ed3b9ca8d
    type: derived

What it detects

This rule flags Windows Security events with Event ID 4799 where the TargetUserName starts with “Administr” and the CallerProcessName ends with “\checkadmin.exe”. The matched behavior indicates account/service permission discovery or enumeration activity targeting local administrator accounts, which can be used for reconnaissance or subsequent privilege escalation. It relies on Windows Security auditing telemetry that records the event ID, target account name, and the initiating process path.

Known false positives

Administrators that use checkadmin.exe tool to enumerate local administrators

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.