mdecrevoisier high experimental sigma

Account renamed to admin (or likely) account to evade defense

Detects scenarios where an attacker rename a non admin account in order to evade SOC & operations vigilance

View Source

Detection Logic

{
  "selection_event": {
    "EventID": 4781
  },
  "selection_pattern": [
    {
      "NewTargetUserName
| startswith": [
        "admin-",
        "adm-",
        "<customer pattern>"
      ]
    },
    {
      "NewTargetUserName
| endswith": [
        "-admin",
        "-adm",
        "<customer pattern>"
      ]
    }
  ],
  "filter": [
    {
      "OldTargetUserName
| startswith": [
        "admin-",
        "adm-",
        "<customer pattern>"
      ]
    },
    {
      "OldTargetUserName
| endswith": [
        "-admin",
        "-adm",
        "<customer pattern>"
      ]
    },
    {
      "TargetSid
| endswith": "-500"
    }
  ],
  "condition": "selection_event and selection_pattern and not filter"
}

False Positives

  • ⚠ builtin admin account renamed for obfuscation

Field Validations

Loading…

Comments (0)

Loading comments...