Windows Security: Privileged user/group SID reconnaissance via SAM auditing (4661)

title: "Windows Security: Privileged user/group SID reconnaissance via SAM auditing (4661)"
id: b9b3d3f0-88cf-4c07-9181-ee76b4465cff
status: test
description: This rule flags Windows Security Event ID 4661 activity targeting SAM_USER or SAM_GROUP objects associated with well-known privileged account identifiers. It also matches object names containing 'admin' while excluding computer accounts (SubjectUserName ending with '$'). This matters because enumeration of privileged principals is commonly used by attackers to identify high-value accounts and groups before attempting escalation or access. The detection relies on Security log telemetry with EventID 4661 and the ObjectType/ObjectName fields.
references:
  - https://web.archive.org/web/20230329163438/https://blog.menasec.net/2019/02/threat-hunting-5-detecting-enumeration.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_account_discovery.yml
author: Samir Bousseaden, Huntrule Team
date: 2019-04-03
modified: 2022-07-13
tags:
  - attack.discovery
  - attack.t1087.002
logsource:
  product: windows
  service: security
  definition: "Requirements: enable Object Access SAM on your Domain Controllers"
detection:
  selection:
    EventID: 4661
    ObjectType:
      - SAM_USER
      - SAM_GROUP
  selection_object:
    - ObjectName|endswith:
        - "-512"
        - "-502"
        - "-500"
        - "-505"
        - "-519"
        - "-520"
        - "-544"
        - "-551"
        - "-555"
    - ObjectName|contains: admin
  filter:
    SubjectUserName|endswith: $
  condition: selection and selection_object and not filter
falsepositives:
  - If source account name is not an admin then its super suspicious
level: high
license: DRL-1.1
related:
  - id: 35ba1d85-724d-42a3-889f-2e2362bcaf23
    type: derived