Account renamed to admin (or likely) account to evade defense

Status: experimental
Severity: high
Log source: product windows, service security
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker rename a non admin account in order to evade SOC & operations vigilance

Known false positives

builtin admin account renamed for obfuscation

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1078.002` Valid Accounts: Domain Accounts

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4781: The name of an account was changed.

Rule body

title: Account renamed to admin (or likely) account to evade defense
description: Detects scenarios where an attacker rename a non admin account in order to evade SOC & operations vigilance
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1098.xxx-Account%20manipulation
tags:
- attack.persistence
- attack.t1078.002
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection_event:
    EventID: 4781 # Account name change

  selection_pattern:
    - NewTargetUserName|startswith:
      - admin-
      - adm-
      - <customer pattern>
    - NewTargetUserName|endswith:
      - -admin
      - -adm
      - <customer pattern>
  filter:
    - OldTargetUserName|startswith: # Original target account name should not be already an admin account
      - admin-
      - adm-
      - <customer pattern>
    - OldTargetUserName|endswith:
      - -admin
      - -adm
      - <customer pattern>
    - TargetSid|endswith: '-500' # Exclude default builtin account
  condition: selection_event and selection_pattern and not filter
falsepositives:
- builtin admin account renamed for obfuscation
level: high

Stages and Predicates

Stage 0: `condition`

selection_event and selection_pattern and not filter

Stage 1: `selection_event`

selection_event:
  EventID: 4781

Stage 2: `selection_pattern`

selection_pattern:
  - NewTargetUserName|startswith:
    - admin-
    - adm-
    - <customer pattern>
  - NewTargetUserName|endswith:
    - -admin
    - -adm
    - <customer pattern>

Stage 3: `not filter`

filter:
  - OldTargetUserName|startswith:
    - admin-
    - adm-
    - <customer pattern>
  - OldTargetUserName|endswith:
    - -admin
    - -adm
    - <customer pattern>
  - TargetSid|endswith: '-500'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`OldTargetUserName`	ends_with	`-adm`	`excludes:OldTargetUserName` `field:"OldTargetUserName" value:"-adm"`
`OldTargetUserName`	ends_with	`-admin`	`excludes:OldTargetUserName` `field:"OldTargetUserName" value:"-admin"`
`OldTargetUserName`	ends_with	`<customer pattern>`	`excludes:OldTargetUserName` `field:"OldTargetUserName" value:"<customer pattern>"`
`OldTargetUserName`	starts_with	`<customer pattern>`	`excludes:OldTargetUserName` `field:"OldTargetUserName" value:"<customer pattern>"`
`OldTargetUserName`	starts_with	`adm-`	`excludes:OldTargetUserName` `field:"OldTargetUserName" value:"adm-"`
`OldTargetUserName`	starts_with	`admin-`	`excludes:OldTargetUserName` `field:"OldTargetUserName" value:"admin-"`
`TargetSid`	ends_with	`-500`	`excludes:TargetSid` `field:"TargetSid" value:"-500"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`NewTargetUserName`	ends_with	`-adm` `-admin` `<customer pattern>`	`field:"NewTargetUserName" kind:ends_with`
`NewTargetUserName`	starts_with	`<customer pattern>` `adm-` `admin-`	`field:"NewTargetUserName" kind:starts_with`