name: Short Lived Windows Accounts
id: b25f6f62-0782-43c1-b403-083231ffd97d
version: 2
date: '2020-07-06'
author: David Dorsey, Splunk
type: batch
datamodel:
- Change
description: This search detects accounts that were created and deleted in a short
  time period.
search: '| tstats `security_content_summariesonly` values(All_Changes.result_id) as
  result_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Change
  where All_Changes.result_id=4720 OR All_Changes.result_id=4726 by _time span=4h
  All_Changes.user All_Changes.dest | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
  | `drop_dm_object_name("All_Changes")` | search result_id = 4720 result_id=4726
  | transaction user connected=false maxspan=240m | table firstTime lastTime count
  user dest result_id | `short_lived_windows_accounts_filter`'
how_to_implement: 'This search requires you to have enabled your Group Management
  Audit Logs in your Local Windows Security Policy and be ingesting those logs.  More
  information on how to enable them can be found here: http://whatevernetworks.com/auditing-group-membership-changes-in-active-directory/'
known_false_positives: It is possible that an administrator created and deleted an
  account in a short time period.  Verifying activity with an administrator is advised.
references: []
tags:
  analytic_story:
  - Account Monitoring and Controls
  asset_type: Windows
  automated_detection_testing: passed
  cis20:
  - CIS 16
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security.log
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-system.log
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log
  mitre_attack_id:
  - T1136.001
  nist:
  - PR.IP
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - All_Changes.result_id
  - All_Changes.user
  - All_Changes.dest
  security_domain: access
