renaming built-in accounts is uncommon in most environments but may occur during initial system hardening or cis benchmark compliance efforts. validate the source user, logon id, and timing against expected change control windows before tuning.

splunk

Techniques

Sample rules

Windows Builtin Account Name Was Changed

source: splunk
technicques:

Description

The following analytic detects renaming of Windows built-in accounts via Event ID 4781. It identifies renames targeting accounts with well-known reserved RIDs (500-504): Administrator, Guest, krbtgt, DefaultAccount, and WDAGUtilityAccount, by matching the TargetSid field against the S-1-5-21-*-50[0-4] pattern. Attackers commonly rename the built-in Administrator account to evade detections that alert on the literal account name, while retaining the full privileges of the RID-500 account. Renaming Guest, krbtgt, or other reserved accounts is highly unusual in any legitimate environment.

Detection logic

`wineventlog_security`
EventCode=4781
TargetSid="S-1-5-21-*"


| where match(TargetSid, "S-1-5-21-.*-50[0-4]$")


| stats count min(_time) as firstTime
              max(_time) as lastTime
  by dest OldTargetUserName NewTargetUserName
     TargetSid SubjectLogonId


| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `windows_builtin_account_name_was_changed_filter`