Splunk unknown stable spl

Windows Computer Account Changed to Domain Controller

Detects a modification to the User Account Control flags for a computer account where the `SERVER_TRUST_ACCOUNT` flag is set. This flag is normally associated with domain controller computer accounts. This activity may indicate a legitimate domain controller promotion or, if unexpected, an attempt to grant a computer account domain controller-like trust within Active Directory.

View Source

Detection Logic

`wineventlog_security`
EventID=4742
UserAccountControl="*%%2088*"
| fillnull
| stats count min(_time) as firstTime
              max(_time) as lastTime
  by Computer TargetUserName UserAccountControl EventID
| rename Computer as dest
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_computer_account_changed_to_domain_controller_filter`

False Positives

  • ⚠ Some legitimate administrative activities during domain controller promotions or system updates may trigger this rule. Filter alerts originating from authorized IT personnel or approved change management processes.

Field Validations

Loading…

Comments (0)

Loading comments...