This search looks for newly created accounts that have been elevated to local administrators.
- Type: TTP
Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- Last Updated: 2020-07-08
- Author: David Dorsey, Splunk
- ID: b25f6f62-0712-43c1-b203-083231ffd97d
Kill Chain Phase
- Actions on Objectives
- Command & Control
- CIS 16
1 2 3 4 5 6 7 `wineventlog_security` EventCode=4720 OR (EventCode=4732 Group_Name=Administrators) | transaction member_id connected=false maxspan=180m | rename member_id as user | stats count min(_time) as firstTime max(_time) as lastTime by user dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_new_local_admin_account_filter`
The SPL above uses the following Macros:
detect_new_local_admin_account_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
List of fields required to use this analytic.
How To Implement
You must be ingesting Windows event logs using the Splunk Windows TA and collecting event code 4720 and 4732
Known False Positives
The activity may be legitimate. For this reason, it's best to verify the account with an administrator and ask whether there was a valid service request for the account creation. If your local administrator group name is not "Administrators", this search may generate an excessive number of false positives
Associated Analytic Story
|42.0||60||70||A $user$ on $dest$ was added recently. Identify if this was legitimate behavior or not.|
The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
source | version: 2