Windows Security: checkadmin.exe TargetUserName starting with Administr (Event ID 4799)

ATT&CK techniques

Execution → Discovery

Recon
Resource Dev
Initial Access
Execution
- T1053.005Scheduled Task
- T1059.001PowerShell
Persistence
- T1053.005Scheduled Task
Priv Esc
- T1053.005Scheduled Task
Defense Evasion
- T1027Obfuscated Files or Information
- T1036.004Masquerade Task or Service
Cred Access
Discovery
- T1012Query Registry
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows Security events (Event ID 4799) where the TargetUserName begins with "Administr" and the CallerProcessName ends with "\checkadmin.exe". Such activity can indicate attempts to discover or enumerate local administrator accounts, which is useful for follow-on privilege escalation and persistence. It relies on Windows Security auditing telemetry that records the caller process and the target account involved in the operation.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange

Windows process command lines matching May 2020 Turla ComRAT command patterns

Suspicious PowerShell Invoke-Expression with Replace Obfuscation

Malicious Emmenhtal JavaScript Loader Spawning Encoded PowerShell

Suspicious Python Interpreter Launching Encoded PowerShell via subprocess

Suspicious PS1Bot PowerShell Payload Written to ProgramData (via file_event)

Suspicious Scheduled Task Running PowerShell Every Minute (via process_creation)

Malicious Non-Interactive Encoded PowerShell Stager (via process_creation)

Suspicious Hidden PowerShell Executing Substring of Dropped File

PowerShell Encoded or Download-Cradle Command Line (via process_creation)

Windows Security: checkadmin.exe TargetUserName starting with Administr (Event ID 4799)

Pivot detection · T1059.001 · 9 related

Changelog

v5

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-security-4799-checkadmin-exe-targeting-administrators-during-operation-w-74ad4314

title: "Windows Security: checkadmin.exe TargetUserName starting with Administr (Event ID 4799)"
id: c54e7de0-9c7a-442f-814f-f18cda0d2aca
status: test
description: This rule flags Windows Security events (Event ID 4799) where the TargetUserName begins with "Administr" and the CallerProcessName ends with "\checkadmin.exe". Such activity can indicate attempts to discover or enumerate local administrator accounts, which is useful for follow-on privilege escalation and persistence. It relies on Windows Security auditing telemetry that records the caller process and the target account involved in the operation.
references:
  - https://web.archive.org/web/20200226212615/https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/
  - https://web.archive.org/web/20200226212615/https://resources.fox-it.com/rs/170-CAK-271/images/201912_Report_Operation_Wocao.pdf
  - https://twitter.com/SBousseaden/status/1207671369963646976
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/TA/Operation-Wocao/win_security_apt_wocao.yml
author: Florian Roth (Nextron Systems), frack113, Huntrule Team
date: 2019-12-20
modified: 2022-11-27
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.discovery
  - attack.stealth
  - attack.t1012
  - attack.t1036.004
  - attack.t1027
  - attack.execution
  - attack.t1053.005
  - attack.t1059.001
  - detection.emerging-threats
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4799
    TargetUserName|startswith: Administr
    CallerProcessName|endswith: \checkadmin.exe
  condition: selection
falsepositives:
  - Administrators that use checkadmin.exe tool to enumerate local administrators
level: high
license: DRL-1.1
related:
  - id: 74ad4314-482e-4c3e-b237-3f7ed3b9ca8d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL