Sigma rule: Standard User In High Privileged Group

Rule

Title

Standard User In High Privileged Group

Status

test

Level

medium

Author

frack113

Date

2023-01-13

Modified

2023-05-05

File

rules/windows/builtin/lsa_server/win_lsa_server_normal_user_admin.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detect standard users login that are part of high privileged groups such as the Administrator group

Log source

product

windows

service

lsa-server

definition

Requirements: Microsoft-Windows-LSA/Operational (199FE037-2B82-40A9-82AC-E1D46C792B99) Event Log must be enabled and collected in order to use this rule.

Detection

selection:
    EventID: 300
    TargetUserSid|startswith: 'S-1-5-21-' # Standard user
    SidList|contains:
        - 'S-1-5-32-544'    # Local admin
        - '-500}'           # Domain admin
        - '-518}'           # Schema admin
        - '-519}'           # Enterprise admin
filter_main_admin:
    TargetUserSid|endswith:
        - '-500'           # Domain admin
        - '-518'           # Schema admin
        - '-519'           # Enterprise admin
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Standard domain users who are part of the administrator group. These users shouldn't have these right. But in the case where it's necessary. They should be filtered out using the "TargetUserName" field

Tags

• attack.credential-access
• attack.privilege-escalation

References

• https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers
• https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection
• https://github.com/nasbench/EVTX-ETW-Resources/blob/7a806a148b3d9d381193d4a80356016e6e8b1ee8/ETWProvidersManifests/Windows11/22H2/W11_22H2_Pro_20221220_22621.963/WEPExplorer/LsaSrv.xml

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/lsa_server/win_lsa_server_normal_user_admin.yml