Name:Windows Builtin Account Name Was Changed id:65e6e8b9-c68c-460f-beb8-48cfe91b4d21 version:1 date:None author:Raven Tait, Splunk status:production type:TTP Description:The following analytic detects renaming of Windows built-in accounts via Event ID 4781.
It identifies renames targeting accounts with well-known reserved RIDs (500-504): Administrator, Guest, krbtgt, DefaultAccount, and WDAGUtilityAccount, by matching the TargetSid field against the S-1-5-21-*-50[0-4] pattern.
Attackers commonly rename the built-in Administrator account to evade detections that alert on the literal account name, while retaining the full privileges of the RID-500 account.
Renaming Guest, krbtgt, or other reserved accounts is highly unusual in any legitimate environment. Data_source:
how_to_implement:To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed. known_false_positives:Renaming built-in accounts is uncommon in most environments but may occur during initial system hardening or CIS benchmark compliance efforts.
Validate the source user, logon ID, and timing against expected change control windows before tuning. References: -https://attack.mitre.org/techniques/T1078/003/ -https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4781 -https://nvd.nist.gov/vuln/detail/cve-2026-47301 -https://medium.com/@omribaso/from-domain-user-to-enterprise-control-microsoft-configuration-manager-rce-0-day-exploit-chain-393c63c680ca -https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab?source=recommendations drilldown_searches: name:'View the detection results for - "$dest$" and "$OldTargetUserName$"' search:'%original_detection_search% | search dest = "$dest$" OldTargetUserName = "$OldTargetUserName$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$dest$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['Windows Defense Evasion Tactics', 'Compromised Windows Host']
