Fake computer account created

Back


Id	c1faf5e8-6958-11ec-90d6-0242ac120003
Rulename	Fake computer account created
Description	This query detects domain user accounts creation (event ID 4720) where the username ends with $. Accounts that end with $ are normally domain computer accounts and when they are created the event ID 4741 is generated instead.
Severity	Medium
Tactics	DefenseEvasion
Techniques	T1564
Required data connectors	SecurityEvents
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Detections/SecurityEvent/FakeComputerAccountCreated.yaml
Version	1.0.4
Arm template	c1faf5e8-6958-11ec-90d6-0242ac120003.json

KQL

SecurityEvent
| where EventID == 4720 and TargetUserName endswith "$"
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by Computer, SubjectUserName, SubjectDomainName, SubjectAccount, SubjectUserSid, SubjectLogonId, 
TargetUserName, TargetDomainName, TargetAccount, TargetSid, UserPrincipalName
| extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
| project-away DomainIndex

YAML

kind: Scheduled
severity: Medium
queryPeriod: 1h
name: Fake computer account created
queryFrequency: 1h
triggerThreshold: 0
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: SubjectAccount
  - identifier: Name
    columnName: SubjectUserName
  - identifier: NTDomain
    columnName: SubjectDomainName
- entityType: Account
  fieldMappings:
  - identifier: Sid
    columnName: SubjectUserSid
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: TargetAccount
  - identifier: Name
    columnName: TargetUserName
  - identifier: NTDomain
    columnName: TargetDomainName
- entityType: Account
  fieldMappings:
  - identifier: Sid
    columnName: TargetSid
- entityType: Host
  fieldMappings:
  - identifier: FullName
    columnName: Computer
  - identifier: HostName
    columnName: HostName
  - identifier: DnsDomain
    columnName: HostNameDomain
triggerOperator: gt
metadata:
  author:
    name: Vasileios Paschalidis
  categories:
    domains:
    - Security - Others
  support:
    tier: Community
  source:
    kind: Community
relevantTechniques:
- T1564
requiredDataConnectors:
- connectorId: SecurityEvents
  dataTypes:
  - SecurityEvent
description: |
  'This query detects domain user accounts creation (event ID 4720) where the username ends with $. 
  Accounts that end with $ are normally domain computer accounts and when they are created the event ID 4741 is generated instead.'  
version: 1.0.4
id: c1faf5e8-6958-11ec-90d6-0242ac120003
query: |
  SecurityEvent
  | where EventID == 4720 and TargetUserName endswith "$"
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by Computer, SubjectUserName, SubjectDomainName, SubjectAccount, SubjectUserSid, SubjectLogonId, 
  TargetUserName, TargetDomainName, TargetAccount, TargetSid, UserPrincipalName
  | extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
  | extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
  | project-away DomainIndex  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/SecurityEvent/FakeComputerAccountCreated.yaml
tactics:
- DefenseEvasion

ARM