Active Directory Privileged User or Group Reconnaissance

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•22

Detects reconnaissance activities targeting privileged Active Directory users or groups by monitoring Windows Security Event ID 4661. The rule specifically looks for access attempts to objects identified as privileged users or groups based on their Security Identifier (SID) suffixes or names containing 'admin'. It filters out activity from machine accounts to reduce false positives.