detection.wiki

Detection rules › Splunk

Windows Increase in User Modification Activity

Status
production
Severity
medium
Group by
_time, signature, status, user
Author
Dean Luxton
Source
github.com/splunk/security_content

This analytic detects an increase in modifications to AD user objects. A large volume of changes to user objects can indicate potential security risks, such as unauthorized access attempts, impairing defences or establishing persistence. By monitoring AD logs for unusual modification patterns, this detection helps identify suspicious behavior that could compromise the integrity and security of the AD environment.

Known false positives

  • Genuine activity

MITRE ATT&CK coverage

TacticTechniques
Persistence
Privilege Escalation
Defense Impairment

Telemetry coverage

ProviderRecord / event type
Security-AuditingEvent ID 4720: A user account was created.
Security-AuditingEvent ID 4722: A user account was enabled.
Security-AuditingEvent ID 4723: An attempt was made to change an account's password.
Security-AuditingEvent ID 4724: An attempt was made to reset an account's password.
Security-AuditingEvent ID 4725: A user account was disabled.
Security-AuditingEvent ID 4726: A user account was deleted.
Security-AuditingEvent ID 4728: A member was added to a security-enabled global group.
Security-AuditingEvent ID 4732: A member was added to a security-enabled local group.
Security-AuditingEvent ID 4733: A member was removed from a security-enabled local group.
Security-AuditingEvent ID 4738: A user account was changed.
Security-AuditingEvent ID 4743: A computer account was deleted.
Security-AuditingEvent ID 4780: The ACL was set on accounts which are members of administrators groups.

Rule body

name: Windows Increase in User Modification Activity
id: 0995fca1-f346-432f-b0bf-a66d14e6b428
version: 9
creation_date: '2024-07-01'
modification_date: '2026-05-13'
author: Dean Luxton
status: production
type: TTP
description: This analytic detects an increase in modifications to AD user objects. A large volume of changes to user objects can indicate potential security risks, such as unauthorized access attempts, impairing defences or establishing persistence. By monitoring AD logs for unusual modification patterns, this detection helps identify suspicious behavior that could compromise the integrity and security of the AD environment.
data_source:
    - Windows Event Log Security 4720
search: |-
    `wineventlog_security` EventCode IN (4720,4722,4723,4724,4725,4726,4728,4732,4733,4738,4743,4780)
      | bucket span=5m _time
      | stats values(TargetDomainName) as TargetDomainName, values(user) as user, dc(user) as userCount, values(user_category) as user_category, values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category) as dest_category
        BY _time, src_user, signature,
           status
      | eventstats avg(userCount) as comp_avg , stdev(userCount) as comp_std
        BY src_user, signature
      | eval upperBound=(comp_avg+comp_std*3)
      | eval isOutlier=if(userCount > 10 and userCount >= upperBound, 1, 0)
      | search isOutlier=1
      | stats values(TargetDomainName) as TargetDomainName, values(user) as user, dc(user) as userCount, values(user_category) as user_category, values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category) as dest_category values(signature) as signature
        BY _time, src_user, status
      | `windows_increase_in_user_modification_activity_filter`
how_to_implement: Run this detection looking over a 7 day timeframe for best results.
known_false_positives: Genuine activity
references: []
finding:
    title: Spike in User Modification actions performed by $src_user$
    entity:
        field: src_user
        type: user
        score: 50
analytic_story:
    - Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
mitre_attack_id:
    - T1098
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: audit

Stages and Predicates

Stage 1: search

`wineventlog_security` EventCode IN (4720,4722,4723,4724,4725,4726,4728,4732,4733,4738,4743,4780)

Stage 2: bucket

| bucket span=5m _time

Stage 3: stats

| stats values(TargetDomainName) as TargetDomainName, values(user) as user, dc(user) as userCount, values(user_category) as user_category, values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category) as dest_category
    BY _time, src_user, signature,
       status

Stage 4: eventstats

| eventstats avg(userCount) as comp_avg , stdev(userCount) as comp_std
    BY src_user, signature

Stage 5: eval

| eval upperBound=(comp_avg+comp_std*3)

Stage 6: eval

| eval isOutlier=if(userCount > 10 and userCount >= upperBound, 1, 0)
isOutlier =
ifuserCount > 10 AND userCount >= upperBound1
else0

Stage 7: search

| search isOutlier=1

Stage 8: stats

| stats values(TargetDomainName) as TargetDomainName, values(user) as user, dc(user) as userCount, values(user_category) as user_category, values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category) as dest_category values(signature) as signature
    BY _time, src_user, status

Stage 9: search

| `windows_increase_in_user_modification_activity_filter`

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
EventCodein
  • 4720 corpus 5 (kusto 3, splunk 2)
  • 4722 corpus 2 (kusto 2)
  • 4723 corpus 4 (splunk 3, kusto 1)
  • 4724 corpus 2 (splunk 2)
  • 4725 corpus 2 (splunk 1, kusto 1)
  • 4726 corpus 2 (splunk 1, kusto 1)
  • 4728 corpus 4 (splunk 3, elastic 1)
  • 4732 corpus 4 (splunk 3, kusto 1)
  • 4733
  • 4738 corpus 8 (splunk 4, elastic 3, kusto 1)
  • 4743
  • 4780
field:"EventID" kind:in
isOutliereq
  • 1 corpus 33 (splunk 33)
field:"isOutlier" kind:eq value:"1"