Admin-level password reset of another account. SubjectUserName=who reset it, TargetUserName=account reset.
Admin resets of privileged account passwords by unexpected accounts indicates credential takeover. Also used in BEC: email admin resets CEO credentials. Attacker with admin access resets accounts to enable access or lock out defenders.
Alert: TargetUserName is Domain Admin, Enterprise Admin, or high-privilege account. Alert: SubjectUserName is a service account or non-IT user. Correlate with subsequent 4624 logon from reset account.
TargetUserNameSubjectUserName | Tactic | Technique |
|---|---|
| Impact | Account Access Removal (T1531) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4724 // An attempt was made to reset an account's password
| project TimeGenerated, Computer, TargetUserName, SubjectUserName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=4724
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# An attempt was made to reset an account's password — add EventData fields: TargetUserName, SubjectUserName`An attempt was made to reset an account's password. Admin-level password reset of another account. SubjectUserName=who reset it, TargetUserName=account reset.
Event 4724 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Account Management' subcategory (Success and/or Failure).
Event 4724 is associated with: Account Access Removal (T1531).
Alert: TargetUserName is Domain Admin, Enterprise Admin, or high-privilege account. Alert: SubjectUserName is a service account or non-IT user. Correlate with subsequent 4624 logon from reset account.