Detection: Windows Computer Account Changed to Domain Controller

Description

Detects a modification to the User Account Control flags for a computer account where the SERVER_TRUST_ACCOUNT flag is set. This flag is normally associated with domain controller computer accounts. This activity may indicate a legitimate domain controller promotion or, if unexpected, an attempt to grant a computer account domain controller-like trust within Active Directory.

Search

 1`wineventlog_security`
 2EventID=4742
 3UserAccountControl="*%%2088*"
 4
 5| fillnull
 6
 7| stats count min(_time) as firstTime
 8              max(_time) as lastTime
 9  by Computer TargetUserName UserAccountControl EventID
10
11
12| rename Computer as dest
13
14| `security_content_ctime(firstTime)`
15
16| `security_content_ctime(lastTime)`
17
18| `windows_computer_account_changed_to_domain_controller_filter`

Data Source

Name	Platform	Sourcetype	Source
Windows Event Log Security 4742	Windows	'XmlWinEventLog'	'XmlWinEventLog:Security'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the Processes node of the Endpoint data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.

Known False Positives

Some legitimate administrative activities during domain controller promotions or system updates may trigger this rule. Filter alerts originating from authorized IT personnel or approved change management processes.

Associated Analytic Story

• Active Directory Privilege Escalation

• Sneaky Active Directory Persistence Tricks

Risk Based Analytics (RBA)

Risk Message:

Computer account User Account Control flags changed to domain controller $UserAccountControl$ on $dest$.

References

• https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4742

• https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1