ad_privileged_users_or_groups_reconnaissance

rule ad_privileged_users_or_groups_reconnaissance {
 meta:
    author = "Samir Bousseaden"
    description = "Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/l4OAHS0HCL7v"
    version = "0.01"
    created = "2021-03-09"
    product = "windows"
    service = "security"
    mitre = "discovery, t1087"

  events:
($selection.metadata.product_event_type = "4661" and ($selection.principal.user.user_display_name = "SAM_USER" or $selection.principal.user.user_display_name = "SAM_GROUP") and ((re.regex($selection.target.registry.registry_value_data, `.*-512`) or re.regex($selection.target.registry.registry_value_data, `.*-502`) or re.regex($selection.target.registry.registry_value_data, `.*-500`) or re.regex($selection.target.registry.registry_value_data, `.*-505`) or re.regex($selection.target.registry.registry_value_data, `.*-519`) or re.regex($selection.target.registry.registry_value_data, `.*-520`) or re.regex($selection.target.registry.registry_value_data, `.*-544`) or re.regex($selection.target.registry.registry_value_data, `.*-551`) or re.regex($selection.target.registry.registry_value_data, `.*-555`) or re.regex($selection.target.registry.registry_value_data, `.*admin.*`)) or (re.regex($selection.target.file.full_path, `.*-512`) or re.regex($selection.target.file.full_path, `.*-502`) or re.regex($selection.target.file.full_path, `.*-500`) or re.regex($selection.target.file.full_path, `.*-505`) or re.regex($selection.target.file.full_path, `.*-519`) or re.regex($selection.target.file.full_path, `.*-520`) or re.regex($selection.target.file.full_path, `.*-544`) or re.regex($selection.target.file.full_path, `.*-551`) or re.regex($selection.target.file.full_path, `.*-555`) or re.regex($selection.target.file.full_path, `.*admin.*`))))

  condition:
    $selection
}