Suspicious Account Creation Followed by Privilege Assignment
Last updated on:
In this page
About the rule
Rule Type
Advanced
Rule Description
A newly created user account was quickly assigned membership to a privileged group.
Severity
Critical
Rule Requirement
Criteria
Action1:
actionname = "User account created"
Action2:
actionname = "Member(s) added to security group" AND USERNAME = Action1.USERNAME
sequence:Action1 followedby Action2 within 15m
select Action1.HOSTNAME,Action1.MESSAGE,Action1.TARGETUSER,Action1.TARGETDOMAIN,Action1.USERNAME,Action1.DOMAIN,Action1.DISPLAYNAME,Action1.MEMBERGROUPSID,Action1.SAMACCOUNTNAME,Action1.SECURITYID,Action1.USERPRINCIPALNAME,Action2.HOSTNAME,Action2.MESSAGE,Action2.GROUPDOMAIN,Action2.GROUPNAME,Action2.TARGETDOMAIN,Action2.TARGETUSER,Action2.USERNAME,Action2.DOMAIN,Action2.MEMBERGROUPSID,Action2.MEMBERSID,Action2.SECURITYID
Detection
Execution Mode
realtime
Log Sources
Active Directory
