alert:
- debug
description: Detects activity as "net user administrator /domain" and "net group domain admins /domain"
filter:
- query:
    query_string:
      query: (data.win.system.eventID:"4661" AND data.win.eventdata.accessMask:"0x2d" AND ((object_type:"SAM_USER" AND object_name.keyword:S\-1\-5\-21\-*\-500) OR (object_type:"SAM_GROUP" AND object_name.keyword:S\-1\-5\-21\-*\-512)))
index: wazuh-alerts-3.x-*
name: 968eef52-9cff-4454-8992-1e74b9cbad6c_0
priority: 2
realert:
  minutes: 0
type: any