Windows Event ID 4797 — An attempt was made to query the existence of a blank password — SecOps Tools

Why event 4797 matters

Attackers scan for accounts with blank passwords as an easy lateral movement path. Tools: CrackMapExec, Metasploit auxiliary modules.

How to detect it

Alert on any occurrence — blank password queries indicate active credential reconnaissance.

Log source

Security

Advanced Audit Policy — enable the 'Account Management' subcategory (Success and/or Failure).

Fields to pivot on

SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

MITRE ATT&CK mapping

Tactic	Technique
Credential Access	Brute Force (T1110)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL

SecurityEvent
| where EventID == 4797   // An attempt was made to query the existence of a blank password
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Security" EventCode=4797
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# An attempt was made to query the existence of a blank password — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`

Hunt event 4797 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Related Account Management events

4720 A user account was created 4722 A user account was enabled 4723 An attempt was made to change an account's password 4724 An attempt was made to reset an account's password 4725 A user account was disabled 4726 A user account was deleted 4728 A member was added to a security-enabled global group 4729 A member was removed from a security-enabled global group 4730 A security-enabled global group was deleted 4731 A security-enabled local group was created 4732 A member was added to a security-enabled local group 4733 A member was removed from a security-enabled local group

Frequently asked questions

What is Windows Event ID 4797?

An attempt was made to query the existence of a blank password. A query was made for an account with a blank password.

Which log records event 4797?

Event 4797 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Account Management' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 4797?

Event 4797 is associated with: Brute Force (T1110).

How do you detect activity around event 4797?

Alert on any occurrence — blank password queries indicate active credential reconnaissance.