Name:Windows Suspicious Burst of Password Changes id:0dcfcab9-e936-43bc-8203-005e17dc0744 version:1 date:None author:Raven Tait, Splunk status:production type:TTP Description:A regular user account performed rapid, repeated password changes across multiple local accounts within a 2-second window.
This pattern is consistent with automated credential manipulation tools that cycle account passwords to deny access to defenders or escalate privileges The speed and volume of changes indicates scripted or tooled activity rather than manual administration, as legitimate password resets do not occur at machine speed across multiple accounts simultaneously. Data_source:
-Windows Event Log Security 4723
-Windows Event Log Security 4724
search:`wineventlog_security` ( EventCode=4723 OR EventCode=4724 ) | eval log_time = strptime(SystemTime, "%Y-%m-%dT%H:%M:%S.%6NZ") | eval log_time = coalesce(log_time, _time) | eval time_bucket = floor(log_time / 2) * 2 | eval SubjectRID = tonumber(replace(SubjectUserSid, ".*-(\d+)$", "\1")) | where SubjectRID >= 1000 | stats count AS EventsForAccount min(log_time) AS firstTime max(log_time) AS lastTime by Computer TargetUserName SubjectUserName time_bucket
| stats dc(TargetUserName) AS AffectedAccounts values(TargetUserName) AS Accounts values(SubjectUserName) AS InitiatingAccounts sum(EventsForAccount) AS TotalEvents max(ChangeRatePerSec) AS PeakChangeRatePerSec min(DurationSecs) AS FastestBurstSecs min(firstTime) AS firstTime max(lastTime) AS lastTime by dest time_bucket
how_to_implement:To successfully implement this search, you need to be ingesting EventID 4723 and EventID 4724 events with the Windows TA. known_false_positives:Service accounts may be responsible for the creation, deletion or modification of accounts for legitimate purposes. Filter as needed. References: -https://github.com/Nightmare-Eclipse/BlueHammer drilldown_searches: earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View the detection results for - "$user$" and "$dest$"' search:'%original_detection_search% | search user = "$user$" dest = "$dest$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$user$" and "$dest$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' analytic_story:['Windows Privilege Escalation', 'BlueHammer']
