A new computer account was created in AD.
MachineAccountQuota abuse: standard domain users can add up to 10 computers by default. Attackers exploit this to create computer accounts for Kerberos resource-based constrained delegation attacks (RBCD) or noPac exploitation.
Alert: computer account created by a standard user account (not admin or computer provisioning account). Monitor SubjectUserName — should be IT provisioning accounts only.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName | Tactic | Technique |
|---|---|
| Privilege Escalation | Valid Accounts: Domain Accounts (T1078.002) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4741 // A computer account was created
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=4741
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# A computer account was created — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`A computer account was created. A new computer account was created in AD.
Event 4741 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Account Management' subcategory (Success and/or Failure).
Event 4741 is associated with: Valid Accounts: Domain Accounts (T1078.002).
Alert: computer account created by a standard user account (not admin or computer provisioning account). Monitor SubjectUserName — should be IT provisioning accounts only.