splApache-2.0from splunk/security_content

Windows Computer Account Created by Computer Account

The following analytic identifies a computer account creating a new computer account with a specific Service Principal Name (SPN) "RestrictedKrbHost". This detection leverages Windows Security Event Logs, specifically EventCode 4741, to identify such activities. This behavior is significant as it may indicate an attempt to establish unauthorized Kerberos authentication channels, potentially leading to lateral movement or privilege escalation. If confirmed malicious, this activity could allow an attacker to impersonate services, access sensitive information, or maintain persistence within the network.

Quality

FP risk

—

Forks

Views

Rule sourcedetections/endpoint/windows_computer_account_created_by_computer_account.yml

`wineventlog_security` EventCode=4741 user_type=computer SubjectDomainName!="NT AUTHORITY" ServicePrincipalNames=*RestrictedKrbHost*
  | stats  count min(_time) as firstTime max(_time) as lastTime
    BY dest, subject, action
       ,src_user, user, user_type,
       SubjectUserName,SubjectDomainName
  | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)`
  | `windows_computer_account_created_by_computer_account_filter`