huntrule

Windows Security: Detects SAM User/Group Access During Domain Recon (Event ID 4661)

Alerts on Event ID 4661 accesses to SAM user/group objects for domain Administrator and Domain Admins.

FreeReviewedSigma · High · v2
Product
windows
Service
security
Author
Florian Roth (Nextron Systems), Jack Croock (method), Jonhnathan Ribeiro (improvements), oscd.community (SigmaHQ), DRL 1.1
Published
2017-03-07
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows Security Event ID 4661 accesses with AccessMask 0x2d to SAM_USER and SAM_GROUP objects. It matches SAM object names in the domain SID range that end with well-known relative identifiers for the built-in Administrator and Domain Admins groups. Such queries can indicate reconnaissance aimed at enumerating privileged accounts and group membership, relying on advanced auditing visibility for SAM access events in security logs.

Reporting behind it

Related detections9 linkedT1069.002 — drag to rearrange
Malicious Active Directory Enumeration via SharpHound or BloodHound (via process_creation)
Suspicious Group Discovery - Command (via process_creation)
SharpHound Host Enumeration Over Kerberos (via security)
Suspicious Active Directory Enumeration via ADWS PowerShell Cmdlets via ps_script
Windows File Events: ADExplorer .dat Snapshot Written by ADExp.exe or ADExplorer.exe
Windows: Sysinternals ADExplorer invoked with snapshot flag to create AD database snapshot
Windows Process Creation: Sysinternals ADExplorer Snapshot Exports Active Directory Database
Windows PowerShell module commandlet names matching known exploitation and post-exploitation tooling
Windows Process Creation: Suspicious PowerShell Commandlets Used by Known Exploitation Tools
Windows Security: Detects SAM User/Group Access During Domain Recon (Event ID 4661)
Pivot detection · T1069.002 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.