A locked account was unlocked. SubjectUserName=who unlocked, TargetUserName=account unlocked.
Attacker with admin access may unlock their own backdoor account or unlock accounts to remove lockout indicators.
Alert: unlocked outside business hours. Correlate with 4625/4740 to understand lockout cause. Unlock without a help-desk ticket is suspicious.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4767 // A user account was unlocked
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=4767
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# A user account was unlocked — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`A user account was unlocked. A locked account was unlocked. SubjectUserName=who unlocked, TargetUserName=account unlocked.
Event 4767 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Account Management' subcategory (Success and/or Failure).
Alert: unlocked outside business hours. Correlate with 4625/4740 to understand lockout cause. Unlock without a help-desk ticket is suspicious.