EVID 4781 : Account Management (Part 2) (Français - Security)
Event Details
Event Type | Audit User Account Management |
---|---|
Event Description | 4781(S) : The name of an account was changed. |
Event ID | 4781 |
Log Fields and Parsing
This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.
Log Field | LogRhythm Default | LogRhythm Default v2.0 | |
---|---|---|---|
Provider | N/A | N/A | |
EventID | <vmid> | <vmid> | |
Version | N/A | N/A | |
Level | <severity> | <severity> | |
Task | <tag1> | <vendorinfo> | |
Opcode | N/A | N/A | |
Keywords | N/A | <result> | |
TimeCreated | N/A | N/A | |
EventRecordID | N/A | N/A | |
Correlation | N/A | N/A | |
Execution | N/A | N/A | |
Channel | N/A | N/A | |
Computer | <dname> | <dname> | |
TargetUserName | N/A | N/A | |
TargetDomainName | N/A | <domainimpacted> | |
TargetSid | N/A | N/A | |
SubjectUserSid | N/A | N/A | |
SubjectUserName | <login> | <login> | |
SubjectDomainName | <domainorigin> | <domainorigin> | |
SubjectLogonId | <session> | <session> | |
PrivilegeList | N/A | N/A | |
SamAccountName | N/A | N/A | |
DisplayName | N/A | N/A | |
UserPrincipalName | N/A | N/A | |
HomeDirectory | N/A | N/A | |
HomePath | N/A | N/A | |
ScriptPath | N/A | N/A | |
ProfilePath | N/A | N/A | |
UserWorkstations | N/A | N/A | |
PasswordLastSet | N/A | N/A | |
AccountExpires | N/A | N/A | |
PrimaryGroupId | N/A | N/A | |
AllowedToDelegateTo | N/A | N/A | |
OldUacValue | N/A | N/A | |
NewUacValue | N/A | N/A | |
UserAccountControl | N/A | N/A | |
UserParameters | N/A | N/A | |
SidHistory | N/A | N/A | |
LogonHours | N/A | N/A | |
DnsHostName | N/A | N/A | |
ServicePrincipalNames | N/A | N/A | |
OldTargetUserName | N/A | <account>, <tag1> | |
NewTargetUserName | <account> | <object> | |
Event Data | <vendorinfo> | N/A | |
ProcessId | <process> | N/A |
Log Processing Settings
This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.
LogRhythm Default
Regex ID | Rule Name | Rule Type | Common Event | Classification |
---|---|---|---|---|
1006905 | Account Management | Base Rule | User Account Attribute Modified | Account Modified |
EVID 4756 : Account Added To Group | Sub Rule | Account Added To Group | Access Granted | |
EVID 4724 : Failed Password Change Attempt | Sub Rule | Password Change Attempted | Other Audit Failure | |
EVID 4723 : Password Change Attempt | Sub Rule | Password Modified | Account Modified | |
EVID 4766 : SID History Add To Account Failed | Sub Rule | SID History Add Failed | Critical | |
EVID 4765 : SID History Added To Account | Sub Rule | Configuration Modified : System | Configuration | |
EVID 4781 : Account Name Changed | Sub Rule | User Account Name Modified | Account Modified | |
EVID 4743 : Computer Account Deleted | Sub Rule | Computer Account Deleted | Account Deleted | |
EVID 4742 : Computer Account Changed | Sub Rule | Computer Account Attribute Modified | Account Modified | |
EVID 4741 : Computer Account Created | Sub Rule | Computer Account Created | Account Created | |
EVID 4738 : User Account Changed | Sub Rule | User Account Attribute Modified | Account Modified | |
EVID 4726 : User Account Deleted | Sub Rule | User Account Deleted | Account Deleted | |
EVID 4725 : User Account Disabled | Sub Rule | Account Disabled | Access Revoked | |
EVID 4724 : Password Change Attempt | Sub Rule | Password Modified | Account Modified | |
EVID 4723 : Failed Password Change Attempt | Sub Rule | Password Change Attempted | Other Audit Failure | |
EVID 4722 : User Account Enabled | Sub Rule | Account Enabled | Access Granted | |
EVID 4720 : User Account Created | Sub Rule | User Account Created | Account Created |
LogRhythm Default v2.0
Regex ID | Rule Name | Rule Type | Common Event | Classification |
---|---|---|---|---|
1011064 | V 2.0 : EVID 4781 : User Account Name Changed | Base Rule | User Account Name Modified | Account Modified |
V 2.0 : EVID 4781 : Computer Account Name Modified | Sub Rule | Computer Account Name Modified | Account Modified |