TODO: Merge into Tactics md’s
Account Modification Use Cases
Grouped by Detection Method
Aggregate Count
- Count of Events per Source User
- Count of Events per Target User
Blacklist Alert
- Member Added to Privileged Group (e.g. destination group contains “admin”)
- Smart Card Logon Disabled (in environments with required 2FA)
Whitelist Alert
- Non-Privileged User Modifying Accounts
- Non-Authorized Service Account Modifying Accounts
- System Account Modifying Accounts
- Non-Privileged User Added to Privileged Group
Levenshtein Score Alert
Rolling Whitelist Alert
- Newly Observed Source User
Shannon Entropy Score Alert
Threshold Alert
- Source User, Destination User where Destination User Count exceeds threshold
Log Source Examples
- Windows Security Event ID 4728: A member was added to a security-enabled global group
- Windows Security Event ID 4738: A user account was changed
- Windows Security Event ID 4732: A member was added to a security-enabled local group
- Windows Security Event ID 4756: A member was added to a security-enabled universal group
- Windows Security Event ID 4767: A user account was unlocked
- Windows Security Event ID 4722: A user account was enabled
- Windows Security Event ID 4723: An attempt was made to change an accounts password
- Windows Security Event ID 4724: An attempt was made to reset an accounts password
- Windows Security Event ID 4725: A user account was disabled
- Windows Security Event ID 4726: A user account was deleted
- Windows Security Event ID 4781: The name of an account was changed
Possible False Positives