| ID | Technique | Tactic |
|---|---|---|
| T1078.002 | Domain Accounts | Initial Access |
Detection: Identify New User Accounts
REMOVED DETECTION
This detection has been removed from the Splunk Threat Research content library and is no longer maintained or supported.
Reason: Detection deprecated as it no longer effectively identifies the intended malicious activity
Removed in version: 5.2.0
If you have any questions or concerns, please reach out to us at research@splunk.com.
Description
This detection search will help profile user accounts in your environment by identifying newly created accounts that have been added to your network in the past week.
Search
1
2| from datamodel Identity_Management.All_Identities
3| eval empStatus=case((now()-startDate)<604800, "Accounts created in last week")
4| search empStatus="Accounts created in last week"
5| `security_content_ctime(endDate)`
6| `security_content_ctime(startDate)`
7| table identity empStatus endDate startDate
8| `identify_new_user_accounts_filter`
Data Source
No data sources specified for this detection.
Macros Used
| Name | Value |
|---|---|
| security_content_ctime | convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$) |
| identify_new_user_accounts_filter | `` |
identify_new_user_accounts_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
MITRE ATT&CK
Kill Chain Phases
NIST
CIS
Threat Actors
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
| Setting | Value |
|---|---|
| Disabled | true |
| Cron Schedule | N/A |
| Earliest Time | N/A |
| Latest Time | N/A |
| Schedule Window | N/A |
| Creates Finding (Notable) | No |
| Creates Intermediate Finding (Risk Event) | No |
Hunting detections do not generate a Finding (Notable) or Intermediate Findings (Risk Events).
Implementation
To successfully implement this search, you need to be populating the Enterprise Security Identity_Management data model in the assets and identity framework.
Known False Positives
If the Identity_Management data model is not updated regularly, this search could give you false positive alerts. Please consider this and investigate appropriately.
Associated Analytic Story
No associated analytic story
Detection Testing
| Test Type | Status | Dataset | Source | Sourcetype |
|---|---|---|---|---|
| Validation | Not Applicable | N/A | N/A | N/A |
| Unit | Not Applicable | N/A | N/A |
N/A |
Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub |
Version: 4