| ID | Technique | Tactic |
|---|---|---|
| T1068 | Exploitation for Privilege Escalation | Privilege Escalation |
Detection: Windows Suspicious Burst of Password Changes
Description
A regular user account performed rapid, repeated password changes across multiple local accounts within a 2-second window. This pattern is consistent with automated credential manipulation tools that cycle account passwords to deny access to defenders or escalate privileges The speed and volume of changes indicates scripted or tooled activity rather than manual administration, as legitimate password resets do not occur at machine speed across multiple accounts simultaneously.
Search
1`wineventlog_security`
2(
3 EventCode=4723
4 OR
5 EventCode=4724
6)
7
8| eval log_time = strptime(SystemTime, "%Y-%m-%dT%H:%M:%S.%6NZ")
9
10| eval log_time = coalesce(log_time, _time)
11
12| eval time_bucket = floor(log_time / 2) * 2
13
14| eval SubjectRID = tonumber(replace(SubjectUserSid, ".*-(\d+)$", "\1"))
15
16| where SubjectRID >= 1000
17
18| stats count AS EventsForAccount
19 min(log_time) AS firstTime
20 max(log_time) AS lastTime
21 by Computer TargetUserName SubjectUserName time_bucket
22
23
24| where EventsForAccount >= 4
25
26| eval DurationSecs = round(lastTime - firstTime, 3), DurationSecs = if(DurationSecs = 0, 0.001, DurationSecs), ChangeRatePerSec = round(EventsForAccount / DurationSecs, 2)
27
28| rename Computer as dest
29
30
31| stats dc(TargetUserName) AS AffectedAccounts
32 values(TargetUserName) AS Accounts
33 values(SubjectUserName) AS InitiatingAccounts
34 sum(EventsForAccount) AS TotalEvents
35 max(ChangeRatePerSec) AS PeakChangeRatePerSec
36 min(DurationSecs) AS FastestBurstSecs
37 min(firstTime) AS firstTime
38 max(lastTime) AS lastTime
39 by dest time_bucket
40
41
42| `security_content_ctime(firstTime)`
43
44| `security_content_ctime(lastTime)`
45
46| `windows_suspicious_burst_of_password_changes_filter`
Data Source
| Name | Platform | Sourcetype | Source |
|---|---|---|---|
| Windows Event Log Security 4723 |  Windows |
'XmlWinEventLog' |
'XmlWinEventLog:Security' |
| Windows Event Log Security 4724 | Windows |
'XmlWinEventLog' |
'XmlWinEventLog:Security' |
Macros Used
| Name | Value |
|---|---|
| security_content_ctime | convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$) |
| windows_suspicious_burst_of_password_changes_filter | search * |
windows_suspicious_burst_of_password_changes_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
MITRE ATT&CK
Kill Chain Phases
NIST
CIS
Threat Actors
Exploitation
DE.CM
CIS 10
CVE
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
| Setting | Value |
|---|---|
| Disabled | true |
| Cron Schedule | 0 * * * * |
| Earliest Time | -70m@m |
| Latest Time | -10m@m |
| Schedule Window | auto |
| Creates Finding (Notable) | Yes |
| Rule Title | %name% |
| Rule Description | %description% |
| Notable Event Fields | user, dest |
| Creates Intermediate Finding (Risk Event) | No |
TTP detections generate a Finding (Notable) and may generate Intermediate Findings (Risk Events) for associated entities.
Implementation
To successfully implement this search, you need to be ingesting EventID 4723 and EventID 4724 events with the Windows TA.
Known False Positives
Service accounts may be responsible for the creation, deletion or modification of accounts for legitimate purposes. Filter as needed.
Associated Analytic Story
Finding
| Title | Entity Field | Entity Type | Risk Score |
|---|---|---|---|
| Rapid burst of password changes of local accounts by $InitiatingAccounts$ on $dest$ | dest | system | 20 |
References
Detection Testing
| Test Type | Status | Dataset | Source | Sourcetype |
|---|---|---|---|---|
| Validation | ✅ Passing | N/A | N/A | N/A |
| Unit | ✅ Passing | Dataset | XmlWinEventLog:Security |
XmlWinEventLog |
| Integration | ✅ Passing | Dataset | XmlWinEventLog:Security |
XmlWinEventLog |
Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 1