Add or Remove Computer from DC

Title: Add or Remove Computer from DC
Status: test
Description:Detects the creation or removal of a computer. Can be used to detect attacks such as DCShadow via the creation of a new SPN.
References:
  -https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md
  -https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4741
  -https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4743
Author: frack113
Date: 2022-10-14
modified:None
Tags:

• -'attack.defense-impairment'
• -'attack.t1207'

Logsource:

• service: security
• product: windows

Detection:
  selection:
    EventID:
      -'4741'
      -'4743'

  condition:selection
Falsepositives:
  -Unknown
Level: low