name: Detect New Local Admin account
id: b25f6f62-0712-43c1-b203-083231ffd97d
version: 2
date: '2020-07-08'
author: David Dorsey, Splunk
type: batch
datamodel: []
description: This search looks for newly created accounts that have been elevated
  to local administrators.
search: '`wineventlog_security` EventCode=4720 OR (EventCode=4732 Group_Name=Administrators)
  | transaction member_id connected=false maxspan=180m | rename member_id as user
  | stats count min(_time) as firstTime max(_time) as lastTime by user dest | `security_content_ctime(firstTime)`|
  `security_content_ctime(lastTime)` | `detect_new_local_admin_account_filter`'
how_to_implement: You must be ingesting Windows event logs using the Splunk Windows
  TA and collecting event code 4720 and 4732
known_false_positives: The activity may be legitimate. For this reason, it's best
  to verify the account with an administrator and ask whether there was a valid service
  request for the account creation. If your local administrator group name is not
  "Administrators", this search may generate an excessive number of false positives
references: []
tags:
  analytic_story:
  - DHS Report TA18-074A
  - HAFNIUM Group
  asset_type: Windows
  automated_detection_testing: passed
  cis20:
  - CIS 16
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security.log
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-system.log
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log
  kill_chain_phases:
  - Actions on Objectives
  - Command and Control
  mitre_attack_id:
  - T1136.001
  nist:
  - PR.AC
  - DE.CM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - EventCode
  - Group_Name
  - member_id
  - dest
  security_domain: access
