Sunturai
Back to results
MediumSigmaHQfrack113

Standard User In High Privileged Group

Detect standard users login that are part of high privileged groups such as the Administrator group

Detection logic

Detection requirements

Log source product
windows
Log source service
lsa_server

Known benign triggers

  • Standard domain users who are part of the administrator group. These users shouldn't have these right. But in the case where it's necessary. They should be filtered out using the "TargetUserName" field

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice