Breadcrumbs

EVID 4720...4767 : Account Management (Part 1) (XML - Security)

Event Details

Event Type

Audit User Account Management

Event Description

  • 4720(S) : A user account was created.

  • 4722(S) : A user account was enabled.

  • 4723(S, F) :  An attempt was made to change an account's password.

  • 4724(S, F) : An attempt was made to reset an account's password.

  • 4725(S) : A user account was disabled.

  • 4726(S) :  A user account was deleted.

  • 4738(S) : A user account was changed.

  • 4741(S) : A computer account was created.

  • 4742(S) : A computer account was changed.

  • 4743(S) : A computer account was deleted.

  • 4767(S) : A user account was unlocked.

Event IDs

4720, 4722, 4723, 4724, 4725, 4726, 4738, 4741, 4742, 4743, 4767

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field

LogRhythm Default

LogRhythm Default v2.0

Provider

N/A

N/A

EventID

<vmid>

<vmid>

Version

N/A

N/A

Level

<severity>

<severity>

Task

N/A

<vendorinfo>

Opcode

N/A

N/A

Keywords

<tag1>

<result>, <tag1>

TimeCreated

N/A

N/A

EventRecordID

N/A

N/A

Correlation

N/A

N/A

Execution

N/A

N/A

Channel

N/A

N/A

Computer

<dname>

<dname>

TargetUserName

<account>, <group>

<domainimpacted>, <account>, <tag2>

TargetDomainName

<domainimpacted>

<domainimpacted>

TargetSid

N/A

N/A

SubjectUserSid

N/A

N/A

SubjectUserName

<login>

<domainorigin>, <login>

SubjectDomainName

N/A

<domainorigin>

SubjectLogonId

<session>

<session>

PrivilegeList

N/A

<subject>

SamAccountName

N/A

<domainimpacted>, <account>, <tag2>

DisplayName

N/A

N/A

UserPrincipalName

N/A

N/A

HomeDirectory

N/A

N/A

HomePath

N/A

N/A

ScriptPath

N/A

N/A

ProfilePath

N/A

N/A

UserWorkstations

N/A

N/A

PasswordLastSet

N/A

N/A

AccountExpires

<objectname>

<objectname>

PrimaryGroupId

N/A

<group>

AllowedToDelegateTo

N/A

N/A

OldUacValue

N/A

N/A

NewUacValue

N/A

<action>

UserAccountControl

<objectname>

<subject>

UserParameters

N/A

N/A

SidHistory

N/A

N/A

LogonHours

N/A

N/A

OldTargetUserName

<object>

N/A

ServicePrincipalNames

N/A

<object>

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID

Rule Name

Rule Type

Common Event

Classification

1007832

Account Management

Base Rule

User Account Attribute Modified

Account Modified

EVID 4720 : User Account Created

Sub Rule

User Account Created

Account Created

EVID 4726 : User Account Deleted

Sub Rule

User Account Deleted

Account Deleted

EVID 4725 : User Account Disabled

Sub Rule

Account Disabled

Access Revoked

EVID 4722 : User Account Enabled

Sub Rule

Account Enabled

Access Granted

EVID 4765 : SID History Added To Account

Sub Rule

Configuration Modified : System

Configuration

EVID 4766 : SID History Add To Account Failed

Sub Rule

SID History Add Failed

Critical

EVID 4724 : Failed Password Change Attempt

Sub Rule

Password Change Attempted

Other Audit Failure

EVID 4723 : Failed Password Change Attempt

Sub Rule

Password Change Attempted

Other Audit Failure

EVID 4781 : Account Name Changed

Sub Rule

User Account Name Modified

Account Modified

EVID 4743 : Computer Account Deleted

Sub Rule

Computer Account Deleted

Account Deleted

EVID 4742 : Computer Account Changed

Sub Rule

Computer Account Attribute Modified

Account Modified

EVID 4741 : Computer Account Created

Sub Rule

Computer Account Created

Account Created

EVID 4756 : Account Added To Group

Sub Rule

Account Added To Group

Access Granted

EVID 4723 : Password Change Attempt

Sub Rule

Password Modified

Account Modified

EVID 4724 : Password Change Attempt

Sub Rule

Password Modified

Account Modified

EVID 4738 : User Account Changed

Sub Rule

User Account Attribute Modified

Account Modified

EVID 4737 : Security Enabled Group Change

Sub Rule

Group Attribute Modified

Account Modified

EVID 4760 : Security Disabled Group Change

Sub Rule

Group Attribute Modified

Account Modified

EVID 4727 : Security Enabled Global Group Created

Sub Rule

Group Created

Account Created

EVID 4731 : Security Enabled Local Group Created

Sub Rule

Group Created

Account Created

EVID 4759 : Security Disabled Univ. Group Created

Sub Rule

Group Created

Account Created

EVID 4767 : User Account Unlocked

Sub Rule

Account Unlocked

Access Granted

EVID 4734 : Security Enabled Local Group Deleted

Sub Rule

Group Deleted

Account Deleted

LogRhythm Default v2.0

Regex ID

Rule Name

Rule Type

Common Event

Classification

1011066

V 2.0 : Account Management

Base Rule

General Audit Message

Other Audit

V 2.0 : EVID 4720 : User Account Created

Sub Rule

User Account Created

Account Created

V 2.0 : EVID 4722 : User Account Enabled

Sub Rule

Account Enabled

Access Granted

V 2.0 : EVID 4723 : Password Changed

Sub Rule

Password Modified

Account Modified

V 2.0 : EVID 4723 : Password Changed

Sub Rule

Password Modified

Account Modified

V 2.0 : EVID 4724 : Password Reset

Sub Rule

Password Modified

Account Modified

V 2.0 : EVID 4724 : Password Reset

Sub Rule

Password Modified

Account Modified

V 2.0 : EVID 4723 : Password Change Failed

Sub Rule

Failed Password Change Attempt

Other Audit Failure

V 2.0 : EVID 4723 : Password Change Failed

Sub Rule

Failed Password Change Attempt

Other Audit Failure

V 2.0 : EVID 4724 : Password Reset Failed

Sub Rule

Failed Password Change Attempt

Other Audit Failure

V 2.0 : EVID 4724 : Password Reset Failed

Sub Rule

Failed Password Change Attempt

Other Audit Failure

V 2.0 : EVID 4725 : Account Disabled

Sub Rule

Account Disabled

Access Revoked

V 2.0 : EVID 4726 : User Account Deleted

Sub Rule

User Account Deleted

Account Deleted

V 2.0 : EVID 4738 : User Account Changed

Sub Rule

User Account Attribute Modified

Account Modified

V 2.0 : EVID 4741 : Computer Account Created

Sub Rule

Computer Account Created

Account Created

V 2.0 : EVID 4742 : Computer Account Changed

Sub Rule

Computer Account Attribute Modified

Account Modified

V 2.0 : EVID 4743 : Computer Account Deleted

Sub Rule

Computer Account Deleted

Account Deleted

V 2.0 : EVID 4767 : Account Unlocked

Sub Rule

Account Unlocked

Access Granted

V 2.0 : EVID 4782 : Password Hash Accessed

Sub Rule

Object Accessed

Access Success

V 2.0 : EVID 4780 : ACL Set On Admin Account

Sub Rule

User Account Attribute Modified

Account Modified

V 2.0 : EVID 4723 : Password Changed

Sub Rule

Password Modified

Account Modified

V 2.0 : EVID 4723 : Password Change Failed

Sub Rule

Failed Password Change Attempt

Other Audit Failure

V 2.0 : EVID 4724 : Password Reset

Sub Rule

Password Modified

Account Modified

V 2.0 : EVID 4724 : Password Reset

Sub Rule

Password Modified

Account Modified

V 2.0 : EVID 4724 : Password Reset Failed

Sub Rule

Failed Password Change Attempt

Other Audit Failure

V 2.0 : EVID 4724 : Password Reset Failed

Sub Rule

Failed Password Change Attempt

Other Audit Failure