huntrule

Windows Security: Detects SAM User/Group Access During Domain Recon (Event ID 4661)

Alerts on Event ID 4661 accesses to SAM user/group objects for domain Administrator and Domain Admins.

FreeReviewedSigma · High · v2
Product
windows
Service
security
Author
Florian Roth (Nextron Systems), Jack Croock (method), Jonhnathan Ribeiro (improvements), oscd.community (SigmaHQ), DRL 1.1
Published
2017-03-07
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows Security Event ID 4661 accesses with AccessMask 0x2d to SAM_USER and SAM_GROUP objects. It matches SAM object names in the domain SID range that end with well-known relative identifiers for the built-in Administrator and Domain Admins groups. Such queries can indicate reconnaissance aimed at enumerating privileged accounts and group membership, relying on advanced auditing visibility for SAM access events in security logs.

Reporting behind it

Related detections9 linkedT1069.002 — drag to rearrange
Suspicious SOAPHound Style LDAP Query with SDflags and all_with_list via security
Suspicious SOAPHound Null Filter LDAP Query via security
Suspicious LDAP Security Descriptor Enumeration via SD_FLAGS Control
Suspicious Delegation Discovery LDAP Search Filter via Bitwise OID
Suspicious Service Principal Name Discovery via setspn Query
Malicious Active Directory Enumeration via SharpHound or BloodHound (via process_creation)
Suspicious Group Discovery - Command (via process_creation)
SharpHound Host Enumeration Over Kerberos (via security)
Suspicious Active Directory Enumeration via ADWS PowerShell Cmdlets via ps_script
Windows Security: Detects SAM User/Group Access During Domain Recon (Event ID 4661)
Pivot detection · T1069.002 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.