name: Detect Computer Changed with Anonymous Account
id: 1400624a-d42d-484d-8843-e6753e6e3645
version: 1
date: '2020-09-18'
author: Rod Soto, Jose Hernandez, Splunk
type: batch
datamodel: []
description: This search looks for Event Code 4742 (Computer Change) or EventCode
  4624 (An account was successfully logged on) with an anonymous account.
search: '`wineventlog_security` EventCode=4624 OR EventCode=4742 TargetUserName="ANONYMOUS
  LOGON" LogonType=3 | stats count values(host) as host, values(TargetDomainName)
  as Domain, values(user) as user | `detect_computer_changed_with_anonymous_account_filter`'
how_to_implement: This search requires audit computer account management to be enabled
  on the system in order to generate Event ID 4742. We strongly recommend that you
  specify your environment-specific configurations (index, source, sourcetype, etc.)
  for Windows Event Logs. Replace the macro definition with configurations for your
  Splunk environment. The search also uses a post-filter macro designed to filter
  out known false positives.
known_false_positives: None thus far found
references:
- https://www.lares.com/blog/from-lares-labs-defensive-guidance-for-zerologon-cve-2020-1472/
tags:
  analytic_story:
  - Detect Zerologon Attack
  asset_type: Windows
  cis20:
  - CIS 6
  - CIS 8
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1210
  nist:
  - DE.AE
  - DE.CM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - EventCode
  - TargetUserName
  - LogonType
  - TargetDomainName
  - user
  security_domain: endpoint
