Detection: Detect Computer Changed with Anonymous Account

Updated Date: 2026-03-18 ID: 1400624a-d42d-484d-8843-e6753e6e3645 Author: Rod Soto, Jose Hernandez, Splunk Type: Hunting Product: Splunk Enterprise Security

Description

The following analytic detects changes to computer accounts using an anonymous logon. It leverages Windows Security Event Codes 4742 (Computer Change) with a SubjectUserName of a value "ANONYMOUS LOGON". This activity can be significant because anonymous logons should not typically be modifying computer accounts, indicating potential unauthorized access or misconfiguration. If confirmed malicious, this could allow an attacker to alter computer accounts, potentially leading to privilege escalation or persistent access within the network.

Search

 1`wineventlog_security`
 2EventCode=4742
 3SubjectUserName="ANONYMOUS LOGON"
 4PasswordLastSet="*"
 5
 6| stats count min(_time) as firstTime max(_time) as lastTime
 7    BY action app dest ProcessID PasswordLastSet
 8       signature signature_id src_user status
 9       SubjectDomainName user user_group vendor_product
10
11| `security_content_ctime(firstTime)`
12
13| `security_content_ctime(lastTime)`
14
15| `detect_computer_changed_with_anonymous_account_filter`

Data Source

Name	Platform	Sourcetype	Source
Windows Event Log Security 4742	Windows	`'XmlWinEventLog'`	`'XmlWinEventLog:Security'`

Macros Used

Name	Value
security_content_ctime	`convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)`
detect_computer_changed_with_anonymous_account_filter	`search *`

detect_computer_changed_with_anonymous_account_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1210	Exploitation of Remote Services	Lateral Movement

Exploitation

DE.AE

CIS 10

CVE

CVE-2020-1472

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Risk Event	False

This configuration file applies to all detections of type hunting.

Implementation

This search requires "Audit Computer Account Management" sub-category in the audit policy to be enabled on the system in order to generate Event ID 4742, as well as "Audit Logon" to generate Event ID 4624. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Event Logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.

Known False Positives

Some legitimate, legacy devices may utilize this functionality and generate false positives. Apply additional tuning as needed.

Associated Analytic Story

Detect Zerologon Attack

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`XmlWinEventLog:Security`	`XmlWinEventLog`
Integration	✅ Passing	Dataset	`XmlWinEventLog:Security`	`XmlWinEventLog`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 10