it is possible third party applications may have a computer account that adds computer accounts, filtering may be required.

Techniques

T1558

Sample rules

Windows Computer Account Created by Computer Account

source: splunk
technicques:
- T1558

Description

The following analytic identifies a computer account creating a new computer account with a specific Service Principal Name (SPN) “RestrictedKrbHost”. This detection leverages Windows Security Event Logs, specifically EventCode 4741, to identify such activities. This behavior is significant as it may indicate an attempt to establish unauthorized Kerberos authentication channels, potentially leading to lateral movement or privilege escalation. If confirmed malicious, this activity could allow an attacker to impersonate services, access sensitive information, or maintain persistence within the network.

Detection logic

`wineventlog_security` EventCode=4741 user_type=computer SubjectDomainName!="NT AUTHORITY" ServicePrincipalNames=*RestrictedKrbHost* 
| stats  count min(_time) as firstTime max(_time) as lastTime by dest, subject, action ,src_user, user, user_type, SubjectUserName,SubjectDomainName 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `windows_computer_account_created_by_computer_account_filter`