TEAM: Huntress SIEM 
PRODUCT: Huntress Managed SIEM
ENVIRONMENT: Microsoft Windows and Active Directory (AD)
SUMMARY: Starter Queries for Windows Security

Query List

Adding/Removing Accounts from Groups

Group Management Events

Account Management Events

Password Resets

Adding/Removing Accounts from Groups

Description

This search returns all instances of accounts being added or removed from Windows groups. These groups could be local groups or Domain groups. The search can be further filtered by specifying the name of a group or groups of interest. Examples of this are documented in the Additional Filter Options section.

Search Query

from logs
| where event.provider=="Microsoft-Windows-Security-Auditing"
| where event.code=="4728" OR event.code=="4732" OR event.code=="4746" OR event.code=="4751" OR event.code=="4756" OR event.code=="4761" OR event.code=="4729" OR event.code=="4733" OR event.code=="4747" OR event.code=="4752" OR event.code=="4757" OR event.code=="4762"
| keep host.hostname, event.code, winlog.event_data.MemberName, winlog.event_data.MemberSid, winlog.event_data.TargetDomainName, winlog.event_data.TargetUserName, winlog.event_data.SubjectDomainName, winlog.event_data.SubjectUserName

Additional Filter Options

Limit to Local Privileged Groups

This query adds a filter to focus on two local groups (Administrators and Remote Desktop Users). These two default groups grant extra privilege to their members with Administrators granting full admin rights and Remote Desktop Users granting the ability to logon over RDP. Both of these groups are used by threat actors to gain persistence.

from logs
| where event.provider=="Microsoft-Windows-Security-Auditing"
| where event.code=="4728" OR event.code=="4732" OR event.code=="4746" OR event.code=="4751" OR event.code=="4756" OR event.code=="4761" OR event.code=="4729" OR event.code=="4733" OR event.code=="4747" OR event.code=="4752" OR event.code=="4757" OR event.code=="4762"
| where winlog.event_data.TargetUserName=="Administrators" OR winlog.event_data.TargetUserName=="Remote Desktop Users"
| keep host.hostname, event.code, winlog.event_data.MemberName, winlog.event_data.MemberSid, winlog.event_data.TargetDomainName, winlog.event_data.TargetUserName, winlog.event_data.SubjectDomainName, winlog.event_data.SubjectUserName

Limit to Domain Privileged Groups

This query adds a filter to focus on three domain groups (Enterprise Admins, Domain Admins, Account Operators). These three default groups grant extra privilege to their members with Enterprise Admins granting full admin rights to all domains in a forest, Domain Admins granting full admin rights to the local domain, and Account Operators granting rights allowing for management of domain accounts.

from logs
| where event.provider=="Microsoft-Windows-Security-Auditing"
| where event.code=="4728" OR event.code=="4732" OR event.code=="4746" OR event.code=="4751" OR event.code=="4756" OR event.code=="4761" OR event.code=="4729" OR event.code=="4733" OR event.code=="4747" OR event.code=="4752" OR event.code=="4757" OR event.code=="4762"
| where winlog.event_data.TargetUserName=="Domain Admins" OR winlog.event_data.TargetUserName=="Account Operators" OR winlog.event_data.TargetUserName=="Enterprise Admins" | keep host.hostname, event.code, winlog.event_data.MemberName, winlog.event_data.MemberSid, winlog.event_data.TargetDomainName, winlog.event_data.TargetUserName, winlog.event_data.SubjectDomainName, winlog.event_data.SubjectUserName

Event Code Breakdown

Kept Field Descriptions

Group Management Events

Description

This search returns data describing the creation or deletion of Windows groups. This includes both local and Domain groups.

Search Query

from logs
| where event.provider=="Microsoft-Windows-Security-Auditing"
| where event.code=="4727" OR event.code=="4731" OR event.code=="4744" OR event.code=="4749" OR event.code=="4754" OR event.code=="4759" OR event.code=="4730" OR event.code=="4734" OR event.code=="4748" OR event.code=="4753" OR event.code=="4758" OR event.code=="4763"
| keep host.hostname, event.code, winlog.event_data.TargetDomainName, winlog.event_data.TargetUserName, winlog.event_data.SubjectDomainName, winlog.event_data.SubjectUserName

Event Code Breakdown

Kept Field Breakdown

Account Management Events

Description

This query returns results indicating the creation, modification, or deletion of an account. Modification is limited to disabling or enabling the account.

Search Query

from logs
| where event.provider=="Microsoft-Windows-Security-Auditing"
| where event.code=="4720" OR event.code=="4722" OR event.code=="4725" OR event.code=="4726" OR event.code=="4741" OR event.code=="4743"
| keep host.hostname, event.code, winlog.event_data.SubjectDomainName, winlog.event_data.SubjectUserName, winlog.event_data.SubjectLogonId, winlog.event_data.TargetDomainName, winlog.event_data.TargetUserName, winlog.event_data.DisplayName

Event Code Breakdown

Kept Field Breakdown

Password Resets

Description

This query returns instances where one account resets the password of another. This is uniquely different from a normal password change event which is when an account changes its own password.

Search Query

from logs
| where event.provider=="Microsoft-Windows-Security-Auditing"
| where event.code=="4724"
| keep host.hostname, winlog.event_data.SubjectDomainName, winlog.event_data.SubjectUserName, winlog.event_data.SubjectLogonId, winlog.event_data.TargetDomainName, winlog.event_data.TargetUserName

Event Code Breakdown

Kept Field Breakdown