KQL Search

Query Details

Security Event Account Created By Unexpected Account

Query

let _MonitoredDomains = toscalar(
    _GetWatchlist("Activity-ExpectedSignificantActivity")
    | where Activity == "ADDomain"
    | summarize make_list(Auxiliar)
    );
let _AccountOperators = toscalar(
    _GetWatchlist("Activity-ExpectedSignificantActivity")
    | where Activity == "AccountOperator"
    | summarize make_list(ActorPrincipalName)
    );
let _ExpectedCreatedAccounts = toscalar(
    _GetWatchlist("Activity-ExpectedSignificantActivity")
    | where Activity == "ADAccountCreation"
    | summarize RegEx = strcat(@'^(', strcat_array(make_list(Auxiliar), '|'), @')$')
    );
SecurityEvent
| where EventID == 4720
| where TargetDomainName in (_MonitoredDomains) and not(Account in (_AccountOperators))
| where not(strcat(SubjectAccount, ",", UserPrincipalName) matches regex _ExpectedCreatedAccounts)
| project
    TimeGenerated,
    Computer,
    Account,
    AccountType,
    Activity,
    TargetAccount,
    DisplayName,
    UserPrincipalName,
    SubjectLogonId,
    EventData

Explanation

This KQL (Kusto Query Language) query is designed to monitor and identify unexpected account creation activities within a specified set of Active Directory (AD) domains. Here's a simplified breakdown of what the query does:

  1. Define Monitored Domains: It retrieves a list of domains that are being monitored for significant activity, specifically for "ADDomain" activities, from a watchlist named "Activity-ExpectedSignificantActivity".

  2. Identify Account Operators: It retrieves a list of account operators (users who are expected to create accounts) from the same watchlist, focusing on "AccountOperator" activities.

  3. Expected Account Creation Patterns: It constructs a regular expression pattern from expected account creation activities, also sourced from the watchlist, to identify which account creations are anticipated.

  4. Filter Security Events: The query then filters security events (specifically, those with EventID 4720, which indicates a user account was created) to find:

    • Events occurring in the monitored domains.
    • Events where the account creator is not in the list of known account operators.
    • Events where the created account does not match the expected account creation patterns.

  5. Output Relevant Information: For events that meet these criteria, it outputs details such as the time of the event, the computer involved, the account created, account type, activity, target account, display name, user principal name, subject logon ID, and event data.

In summary, this query is used to detect potentially unauthorized or unexpected account creation activities in specific AD domains by comparing them against known patterns and authorized operators.