EVID 4720...4767 : Account Management (Part 1) (XML - Security)

Audit User Account Management

• 4720(S) : A user account was created.

• 4722(S) : A user account was enabled.

• 4723(S, F) :  An attempt was made to change an account's password.

• 4724(S, F) : An attempt was made to reset an account's password.

• 4725(S) : A user account was disabled.

• 4726(S) :  A user account was deleted.

• 4738(S) : A user account was changed.

• 4741(S) : A computer account was created.

• 4742(S) : A computer account was changed.

• 4743(S) : A computer account was deleted.

• 4767(S) : A user account was unlocked.
  

4720, 4722, 4723, 4724, 4725, 4726, 4738, 4741, 4742, 4743, 4767

Provider

N/A

N/A

EventID

<vmid>

<vmid>

Version

N/A

N/A

Level

<severity>

<severity>

Task

N/A

<vendorinfo>

Opcode

N/A

N/A

Keywords

<tag1>

<result>, <tag1>

TimeCreated

N/A

N/A

EventRecordID

N/A

N/A

Correlation

N/A

N/A

Execution

N/A

N/A

Channel

N/A

N/A

Computer

<dname>

<dname>

TargetUserName

<account>, <group>

<domainimpacted>, <account>, <tag2>

TargetDomainName

<domainimpacted>

<domainimpacted>

TargetSid

N/A

N/A

SubjectUserSid

N/A

N/A

SubjectUserName

<login>

<domainorigin>, <login>

SubjectDomainName

N/A

<domainorigin>

SubjectLogonId

<session>

<session>

PrivilegeList

N/A

<subject>

SamAccountName

N/A

<domainimpacted>, <account>, <tag2>

DisplayName

N/A

N/A

UserPrincipalName

N/A

N/A

HomeDirectory

N/A

N/A

HomePath

N/A

N/A

ScriptPath

N/A

N/A

ProfilePath

N/A

N/A

UserWorkstations

N/A

N/A

PasswordLastSet

N/A

N/A

AccountExpires

<objectname>

<objectname>

PrimaryGroupId

N/A

<group>

AllowedToDelegateTo

N/A

N/A

OldUacValue

N/A

N/A

NewUacValue

N/A

<action>

UserAccountControl

<objectname>

<subject>

UserParameters

N/A

N/A

SidHistory

N/A

N/A

LogonHours

N/A

N/A

OldTargetUserName

<object>

N/A

ServicePrincipalNames

N/A

<object>

1007832

Account Management

Base Rule

User Account Attribute Modified

Account Modified

EVID 4720 : User Account Created

Sub Rule

User Account Created

Account Created

EVID 4726 : User Account Deleted

Sub Rule

User Account Deleted

Account Deleted

EVID 4725 : User Account Disabled

Sub Rule

Account Disabled

Access Revoked

EVID 4722 : User Account Enabled

Sub Rule

Account Enabled

Access Granted

EVID 4765 : SID History Added To Account

Sub Rule

Configuration Modified : System

Configuration

EVID 4766 : SID History Add To Account Failed

Sub Rule

SID History Add Failed

Critical

EVID 4724 : Failed Password Change Attempt

Sub Rule

Password Change Attempted

Other Audit Failure

EVID 4723 : Failed Password Change Attempt

Sub Rule

Password Change Attempted

Other Audit Failure

EVID 4781 : Account Name Changed

Sub Rule

User Account Name Modified

Account Modified

EVID 4743 : Computer Account Deleted

Sub Rule

Computer Account Deleted

Account Deleted

EVID 4742 : Computer Account Changed

Sub Rule

Computer Account Attribute Modified

Account Modified

EVID 4741 : Computer Account Created

Sub Rule

Computer Account Created

Account Created

EVID 4756 : Account Added To Group

Sub Rule

Account Added To Group

Access Granted

EVID 4723 : Password Change Attempt

Sub Rule

Password Modified

Account Modified

EVID 4724 : Password Change Attempt

Sub Rule

Password Modified

Account Modified

EVID 4738 : User Account Changed

Sub Rule

User Account Attribute Modified

Account Modified

EVID 4737 : Security Enabled Group Change

Sub Rule

Group Attribute Modified

Account Modified

EVID 4760 : Security Disabled Group Change

Sub Rule

Group Attribute Modified

Account Modified

EVID 4727 : Security Enabled Global Group Created

Sub Rule

Group Created

Account Created

EVID 4731 : Security Enabled Local Group Created

Sub Rule

Group Created

Account Created

EVID 4759 : Security Disabled Univ. Group Created

Sub Rule

Group Created

Account Created

EVID 4767 : User Account Unlocked

Sub Rule

Account Unlocked

Access Granted

EVID 4734 : Security Enabled Local Group Deleted

Sub Rule

Group Deleted

Account Deleted

1011066

V 2.0 : Account Management

Base Rule

General Audit Message

Other Audit

V 2.0 : EVID 4720 : User Account Created

Sub Rule

User Account Created

Account Created

V 2.0 : EVID 4722 : User Account Enabled

Sub Rule

Account Enabled

Access Granted

V 2.0 : EVID 4723 : Password Changed

Sub Rule

Password Modified

Account Modified

V 2.0 : EVID 4723 : Password Changed

Sub Rule

Password Modified

Account Modified

V 2.0 : EVID 4724 : Password Reset

Sub Rule

Password Modified

Account Modified

V 2.0 : EVID 4724 : Password Reset

Sub Rule

Password Modified

Account Modified

V 2.0 : EVID 4723 : Password Change Failed

Sub Rule

Failed Password Change Attempt

Other Audit Failure

V 2.0 : EVID 4723 : Password Change Failed

Sub Rule

Failed Password Change Attempt

Other Audit Failure

V 2.0 : EVID 4724 : Password Reset Failed

Sub Rule

Failed Password Change Attempt

Other Audit Failure

V 2.0 : EVID 4724 : Password Reset Failed

Sub Rule

Failed Password Change Attempt

Other Audit Failure

V 2.0 : EVID 4725 : Account Disabled

Sub Rule

Account Disabled

Access Revoked

V 2.0 : EVID 4726 : User Account Deleted

Sub Rule

User Account Deleted

Account Deleted

V 2.0 : EVID 4738 : User Account Changed

Sub Rule

User Account Attribute Modified

Account Modified

V 2.0 : EVID 4741 : Computer Account Created

Sub Rule

Computer Account Created

Account Created

V 2.0 : EVID 4742 : Computer Account Changed

Sub Rule

Computer Account Attribute Modified

Account Modified

V 2.0 : EVID 4743 : Computer Account Deleted

Sub Rule

Computer Account Deleted

Account Deleted

V 2.0 : EVID 4767 : Account Unlocked

Sub Rule

Account Unlocked

Access Granted

V 2.0 : EVID 4782 : Password Hash Accessed

Sub Rule

Object Accessed

Access Success

V 2.0 : EVID 4780 : ACL Set On Admin Account

Sub Rule

User Account Attribute Modified

Account Modified

V 2.0 : EVID 4723 : Password Changed

Sub Rule

Password Modified

Account Modified

V 2.0 : EVID 4723 : Password Change Failed

Sub Rule

Failed Password Change Attempt

Other Audit Failure

V 2.0 : EVID 4724 : Password Reset

Sub Rule

Password Modified

Account Modified

V 2.0 : EVID 4724 : Password Reset

Sub Rule

Password Modified

Account Modified

V 2.0 : EVID 4724 : Password Reset Failed

Sub Rule

Failed Password Change Attempt

Other Audit Failure

V 2.0 : EVID 4724 : Password Reset Failed

Sub Rule

Failed Password Change Attempt

Other Audit Failure