User-initiated password change (not admin reset). SubjectUserName and TargetUserName are typically the same.
Attacker who has compromised an account may change the password to lock out the legitimate user (T1531). Watch for changes immediately before 4647 (logoff) of that account.
Alert: SubjectUserName != TargetUserName (that is a reset, use 4724). Alert: password change immediately before account disable (4725). Low noise, cross-correlate for context.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName | Tactic | Technique |
|---|---|
| Impact | Account Access Removal (T1531) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4723 // An attempt was made to change an account's password
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=4723
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# An attempt was made to change an account's password — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`An attempt was made to change an account's password. User-initiated password change (not admin reset). SubjectUserName and TargetUserName are typically the same.
Event 4723 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Account Management' subcategory (Success and/or Failure).
Event 4723 is associated with: Account Access Removal (T1531).
Alert: SubjectUserName != TargetUserName (that is a reset, use 4724). Alert: password change immediately before account disable (4725). Low noise, cross-correlate for context.