Windows Security Event 4661 SAM Object Access: Domain Administrator/Group Recon

title: "Windows Security Event 4661 SAM Object Access: Domain Administrator/Group Recon"
id: d93d0808-49eb-4fe7-aece-d3e37dd51d6b
status: test
description: This rule flags Windows Security audit events (Event ID 4661) where access to SAM_USER or SAM_GROUP objects is requested with a specific access mask (0x2d). It targets SAM object names within a domain SID range and ending in well-known relative identifiers for the Administrator account (-500) and the Domain Admins group (-512). Such activity can indicate reconnaissance or permission discovery against high-privilege principals. Telemetry relies on Windows Security logs capturing ObjectType, ObjectName, AccessMask, and EventID from the host producing the audit event.
references:
  - https://findingbad.blogspot.de/2017/01/hunting-what-does-it-look-like.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_net_recon_activity.yml
author: Florian Roth (Nextron Systems), Jack Croock (method), Jonhnathan Ribeiro (improvements), oscd.community, Huntrule Team
date: 2017-03-07
modified: 2022-08-22
tags:
  - attack.discovery
  - attack.t1087.002
  - attack.t1069.002
  - attack.s0039
logsource:
  product: windows
  service: security
  definition: The volume of Event ID 4661 is high on Domain Controllers and therefore "Audit SAM" and "Audit Kernel Object" advanced audit policy settings are not configured in the recommendations for server systems
detection:
  selection:
    EventID: 4661
    AccessMask: "0x2d"
    ObjectType:
      - SAM_USER
      - SAM_GROUP
    ObjectName|startswith: S-1-5-21-
    ObjectName|endswith:
      - "-500"
      - "-512"
  condition: selection
falsepositives:
  - Administrator activity
level: high
license: DRL-1.1
related:
  - id: 968eef52-9cff-4454-8992-1e74b9cbad6c
    type: derived