Windows Suspicious Burst of Password Changes
Description
A regular user account performed rapid, repeated password changes across multiple local accounts within a 2-second window. This pattern is consistent with automated credential manipulation tools that cycle account passwords to deny access to defenders or escalate privileges The speed and volume of changes indicates scripted or tooled activity rather than manual administration, as legitimate password resets do not occur at machine speed across multiple accounts simultaneously.
Query · spl
`wineventlog_security`
(
EventCode=4723
OR
EventCode=4724
)
| eval log_time = strptime(SystemTime, "%Y-%m-%dT%H:%M:%S.%6NZ")
| eval log_time = coalesce(log_time, _time)
| eval time_bucket = floor(log_time / 2) * 2
| eval SubjectRID = tonumber(replace(SubjectUserSid, ".*-(\d+)$", "\1"))
| where SubjectRID >= 1000
| stats count AS EventsForAccount
min(log_time) AS firstTime
max(log_time) AS lastTime
by Computer TargetUserName SubjectUserName time_bucket
| where EventsForAccount >= 4
| eval DurationSecs = round(lastTime - firstTime, 3), DurationSecs = if(DurationSecs = 0, 0.001, DurationSecs), ChangeRatePerSec = round(EventsForAccount / DurationSecs, 2)
| rename Computer as dest
| stats dc(TargetUserName) AS AffectedAccounts
values(TargetUserName) AS Accounts
values(SubjectUserName) AS InitiatingAccounts
sum(EventsForAccount) AS TotalEvents
max(ChangeRatePerSec) AS PeakChangeRatePerSec
min(DurationSecs) AS FastestBurstSecs
min(firstTime) AS firstTime
max(lastTime) AS lastTime
by dest time_bucket
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_suspicious_burst_of_password_changes_filter`
Implementation guide
To successfully implement this search, you need to be ingesting EventID 4723 and EventID 4724 events with the Windows TA.
Known false positives
- Service accounts may be responsible for the creation, deletion or modification of accounts for legitimate purposes. Filter as needed.
Analyst notes
Known false positives: Service accounts may be responsible for the creation, deletion or modification of accounts for legitimate purposes. Filter as needed.