AD user enabled and password not set within 48 hours

Status: available
Severity: low
Time window: 3d
Source: github.com/Azure/Azure-Sentinel

Identifies when an account is enabled with a default password and the password is not set by the user within 48 hours. Effectively, there is an event 4722 indicating an account was enabled and within 48 hours, no event 4723 occurs which indicates there was no attempt by the user to set the password. This will show any attempts (success or fail) that occur after 48 hours, which can indicate too long of a time period in setting the password to something that only the user knows. It is recommended that this time period is adjusted per your internal company policy.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1098` Account Manipulation

Event coverage

Provider	Event	Title
Security-Auditing	Event ID 4722	A user account was enabled.
Security-Auditing	Event ID 4723	An attempt was made to change an account's password.

Rule body kusto

id: 62085097-d113-459f-9ea7-30216f2ee6af
name: AD user enabled and password not set within 48 hours
description: |
  'Identifies when an account is enabled with a default password and the password is not set by the user within 48 hours.
  Effectively, there is an event 4722 indicating an account was enabled and within 48 hours, no event 4723 occurs which
  indicates there was no attempt by the user to set the password. This will show any attempts (success or fail) that occur
  after 48 hours, which can indicate too long of a time period in setting the password to something that only the user knows.
  It is recommended that this time period is adjusted per your internal company policy.'
severity: Low
requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
  - connectorId: WindowsSecurityEvents
    dataTypes:
      - SecurityEvent
queryFrequency: 1d
queryPeriod: 3d
triggerOperator: gt
triggerThreshold: 0
status: Available
tactics:
  - Persistence
relevantTechniques:
  - T1098
query: |
  let starttime = 3d;
  let SecEvents = materialize ( SecurityEvent | where TimeGenerated >= ago(starttime)
  | where EventID in (4722,4723) | where TargetUserName !endswith "$"
  | project TimeGenerated, EventID, Activity, Computer, TargetAccount, TargetSid, SubjectAccount, SubjectUserSid);
  let userEnable = SecEvents
  | extend EventID4722Time = TimeGenerated
  // 4722: User Account Enabled
  | where EventID == 4722
  | project Time_Event4722 = TimeGenerated, TargetAccount, TargetSid, SubjectAccount_Event4722 = SubjectAccount, SubjectUserSid_Event4722 = SubjectUserSid, Activity_4722 = Activity, Computer_4722 = Computer;
  let userPwdSet = SecEvents
  // 4723: Attempt made by user to set password
  | where EventID == 4723
  | project Time_Event4723 = TimeGenerated, TargetAccount, TargetSid, SubjectAccount_Event4723 = SubjectAccount, SubjectUserSid_Event4723 = SubjectUserSid, Activity_4723 = Activity, Computer_4723 = Computer;
  userEnable | join kind=leftouter userPwdSet on TargetAccount, TargetSid
  | extend PasswordSetAttemptDelta_Min = datetime_diff('minute', Time_Event4723, Time_Event4722)
  | where PasswordSetAttemptDelta_Min > 2880 or isempty(PasswordSetAttemptDelta_Min)
  | project-away TargetAccount1, TargetSid1
  | extend Reason = @"User either has not yet attempted to set the initial password after account was enabled or it occurred after 48 hours"
  | order by Time_Event4722 asc
  | project-reorder Time_Event4722, Time_Event4723, PasswordSetAttemptDelta_Min, TargetAccount, TargetSid
  | extend Computer = coalesce(Computer_4723, Computer_4722)
  | extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
  | extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
  | extend AccountName = tostring(split(TargetAccount, "\\")[1]), AccountNTDomain = tostring(split(TargetAccount, "\\")[0])
  | project-away DomainIndex
entityMappings:
  - entityType: Account
    fieldMappings: 
      - identifier: FullName
        columnName: TargetAccount
      - identifier: Name
        columnName: AccountName
      - identifier: NTDomain
        columnName: AccountNTDomain
  - entityType: Account
    fieldMappings:
      - identifier: Sid
        columnName: TargetSid
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: Computer
      - identifier: HostName
        columnName: HostName
      - identifier: DnsDomain
        columnName: HostNameDomain
version: 1.0.4
kind: Scheduled

Stages and Predicates

Parameters

let starttime = 3d;

Let binding: `userPwdSet`

let userPwdSet = SecEvents
| where EventID == 4723
| project Time_Event4723 = TimeGenerated, TargetAccount, TargetSid, SubjectAccount_Event4723 = SubjectAccount, SubjectUserSid_Event4723 = SubjectUserSid, Activity_4723 = Activity, Computer_4723 = Computer;

Derived from SecEvents.

The stages below define let userEnable (the rule's main pipeline source).

Stage 1: `source`

let SecEvents

Stage 2: `source`

let userEnable

Stage 3: `source`

let userPwdSet

Stage 4: `source`

SecurityEvent

Stage 5: `where`

| where TimeGenerated >= ago(starttime)

Stage 6: `where`

| where EventID in (4722,4723)

Stage 7: `where`

| where TargetUserName !endswith "$"

Stage 8: `project`

| project TimeGenerated, EventID, Activity, Computer, TargetAccount, TargetSid, SubjectAccount, SubjectUserSid

Stage 9: `extend`

| extend EventID4722Time = TimeGenerated

Stage 10: `where`

| where EventID == 4722

Stage 11: `project`

| project Time_Event4722 = TimeGenerated, TargetAccount, TargetSid, SubjectAccount_Event4722 = SubjectAccount, SubjectUserSid_Event4722 = SubjectUserSid, Activity_4722 = Activity, Computer_4722 = Computer

The stages below run on userEnable (the outer pipeline).

Stage 12: `join`

userEnable
| join kind=leftouter userPwdSet on TargetAccount, TargetSid

Stage 13: `extend`

| extend PasswordSetAttemptDelta_Min = datetime_diff('minute', Time_Event4723, Time_Event4722)

Stage 14: `where`

| where PasswordSetAttemptDelta_Min > 2880 or isempty(PasswordSetAttemptDelta_Min)

Stage 15: `project-away`

| project-away TargetAccount1, TargetSid1

Stage 16: `extend`

| extend Reason = @"User either has not yet attempted to set the initial password after account was enabled or it occurred after 48 hours"

Stage 17: `sort`

| order by Time_Event4722 asc

Stage 18: `project-reorder`

| project-reorder Time_Event4722, Time_Event4723, PasswordSetAttemptDelta_Min, TargetAccount, TargetSid

Stage 19: `extend` (4 consecutive steps)

| extend Computer = coalesce(Computer_4723, Computer_4722)
| extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
| extend AccountName = tostring(split(TargetAccount, "\\")[1]), AccountNTDomain = tostring(split(TargetAccount, "\\")[0])

Stage 20: `project-away`

| project-away DomainIndex

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

Field	Kind	Excluded values
`TargetUserName`	ends_with	`$`
`TargetUserName`	ends_with	`$`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`EventID`	eq	`4722` transforms: `cased` corpus 2 (kusto 2) `4723` transforms: `cased` corpus 2 (splunk 1, kusto 1)
`EventID`	in	`4722` transforms: `cased` corpus 2 (kusto 2) `4723` transforms: `cased` corpus 2 (splunk 1, kusto 1)
`PasswordSetAttemptDelta_Min`	gt	`2880` transforms: `cased`
`PasswordSetAttemptDelta_Min`	is_null	(no value, null check)

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

Field	Source
`Activity_4722`	`project`
`Computer_4722`	`project`
`SubjectAccount_Event4722`	`project`
`SubjectUserSid_Event4722`	`project`
`TargetAccount`	`project`
`TargetSid`	`project`
`Time_Event4722`	`project`
`PasswordSetAttemptDelta_Min`	`extend`
`Reason`	`extend`
`Computer`	`extend`
`HostName`	`extend`
`HostNameDomain`	`extend`
`AccountNTDomain`	`extend`
`AccountName`	`extend`

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

AD user enabled and password not set within 48 hours

MITRE ATT&CK coverage

Event coverage

Rule body kusto

Stages and Predicates

Parameters

Let binding: `userPwdSet`

Stage 1: `source`

Stage 2: `source`

Stage 3: `source`

Stage 4: `source`

Stage 5: `where`

Stage 6: `where`

Stage 7: `where`

Stage 8: `project`

Stage 9: `extend`

Stage 10: `where`

Stage 11: `project`

Stage 12: `join`

Stage 13: `extend`

Stage 14: `where`

Stage 15: `project-away`

Stage 16: `extend`

Stage 17: `sort`

Stage 18: `project-reorder`

Stage 19: `extend` (4 consecutive steps)

Stage 20: `project-away`

Exclusions

Indicators

Output fields

Keyboard shortcuts

Search operators

AD user enabled and password not set within 48 hours

MITRE ATT&CK coverage

Event coverage

Rule body kusto

Stages and Predicates

Parameters

Let binding: userPwdSet

Stage 1: source

Stage 2: source

Stage 3: source

Stage 4: source

Stage 5: where

Stage 6: where

Stage 7: where

Stage 8: project

Stage 9: extend

Stage 10: where

Stage 11: project

Stage 12: join

Stage 13: extend

Stage 14: where

Stage 15: project-away

Stage 16: extend

Stage 17: sort

Stage 18: project-reorder

Stage 19: extend (4 consecutive steps)

Stage 20: project-away

Exclusions

Indicators

Output fields

Let binding: `userPwdSet`

Stage 1: `source`

Stage 2: `source`

Stage 3: `source`

Stage 4: `source`

Stage 5: `where`

Stage 6: `where`

Stage 7: `where`

Stage 8: `project`

Stage 9: `extend`

Stage 10: `where`

Stage 11: `project`

Stage 12: `join`

Stage 13: `extend`

Stage 14: `where`

Stage 15: `project-away`

Stage 16: `extend`

Stage 17: `sort`

Stage 18: `project-reorder`

Stage 19: `extend` (4 consecutive steps)

Stage 20: `project-away`