Improve "Windows AD Privileged Object Access Activity": rename to Privileged Group Enumeration and filter on member/memberOf Properties

Open Beginner friendly
  • Is something wrong?
#4,400 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
72/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Active
Tech stack
python
Domain
security

Research direction

Find the detection named Windows AD Privileged Object Access Activity and its _filter macro in the Splunk security content files. Read the detection's search and the nearby tests or validation for detection content first. Rename it to Windows AD Privileged Group Enumeration and filter Properties for the listed membership attributes; done when the name, description, macro, and search agree and the updated detection passes the repository's validation.

Written by the indexing model from the issue text.

Description

enhancement

Summary

The detection Windows AD Privileged Object Access Activity has two issues: its name does not match its scope, and its logic is too noisy for production use.

Problem 1: Misleading name

Every value in the ObjectName IN (...) list is a privileged group (Domain Admins, Enterprise Admins, Backup Operators, Schema Admins, etc.). The rule does not cover other privileged objects (AdminSDHolder, krbtgt, domain root, GPOs), so "Privileged Object" overstates its coverage.

Suggestion: Rename to Windows AD Privileged Group Enumeration and update the name, description, and _filter macro accordingly.

Problem 2: Missing Properties filter

The search matches any 4662 event on a privileged group, regardless of which attribute was accessed. Event 4662 is generated by many benign operations (security descriptor reads, backup agents, Exchange, management tooling). The real indicator of group enumeration is access to the membership attribute in the Properties field. Without it, the output is very noisy.

Proposed change

Add a filter on the membership attribute GUIDs:

  • memberOf: bf967991-0de6-11d0-8559-00c04fd8d5cd
  • member: bf9679c0-0de6-11d0-8559-00c04fd8d5cd
`wineventlog_security` EventCode=4662 ObjectName IN ( "CN=Account Operators,*", ... , "CN=Organization Management,*")
  Properties IN ("*bf967991-0de6-11d0-8559-00c04fd8d5cd*", "*bf9679c0-0de6-11d0-8559-00c04fd8d5cd*", "*member*")
| rex field=ObjectName "CN\=(?<object_name>[^,]+)"
| stats values(Computer) as dest, values(object_name) as object_name, dc(ObjectName) as object_count, min(_time) as firstTime, max(_time) as lastTime, count BY SubjectUserName
| rename SubjectUserName as user
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_ad_privileged_group_enumeration_filter`
Dominant language
Python
Stars
1.7k
Forks
507
Avg merge
2d 17h
Merged PRs (30d)
35

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from splunk/security_content

All issues in splunk/security_content

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.