mdecrevoisier medium experimental sigma

Account set with password not required (weakness introduction)

Detects scenarios where an attacker set an account with password not required to perform privilege escalation attack.

View Source

Detection Logic

{
  "selection": {
    "EventID": 4738,
    "UserAccountControl": "%%2082"
  },
  "condition": "selection"
}

False Positives

  • ⚠ IAM solutions generating accounts

Field Validations

Loading…

Comments (0)

Loading comments...