Detection rules › Elastic

Account Password Reset Remotely

Author
Elastic
Source
upstream

Identifies an attempt to reset a potentially privileged account password remotely. Adversaries may manipulate account passwords to maintain access or evade password duration policies and preserve compromised credentials.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1098 Account Manipulation
Privilege EscalationT1098 Account Manipulation
ImpactT1531 Account Access Removal

Event coverage

ProviderEvent IDTitle
Security-Auditing4624An account was successfully logged on.
Security-Auditing4724An attempt was made to reset an account's password.

Stages and Predicates

Stage 1: eql:authentication

not winlog.event_data.TargetUserName:"svc*" and event.action:"logged-in" and event.outcome:"success" and not source.ip:"127.0.0.1" and not source.ip:"::1" and winlog.logon.type:"Network"

Stage 2: eql:iam

(winlog.event_data.TargetSid:"S-1-5-21-*-500" or winlog.event_data.TargetUserName:"Admin") and event.action:"reset-password"

Exclusions

Top-level NOT(...) conjuncts — predicates this rule actively suppresses.

StageFieldKindExcluded values
1userwildcardsvc*, PIM_*, _*_, *-*-*, *$

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
event.actioneq
  • logged-in corpus 7 (elastic 7)
  • reset-password
event.outcomeeq
  • success corpus 8 (elastic 8)
source.ipne
  • 127.0.0.1 corpus 8 (elastic 8)
  • ::1 corpus 7 (elastic 7)
winlog.event_data.TargetSidwildcard
  • S-1-12-1-*-500
  • S-1-5-21-*-500
winlog.event_data.TargetUserNamewildcard
  • *ADM*
  • *Admin*
  • *DC0*
  • *DMZ*
  • *SVC*
  • *service*
  • *super*
winlog.logon.typewildcard
  • Network corpus 3 (elastic 3)