LoFP / user accounts can be used as service accounts and have their password set never to expire. this is a bad security practice that exposes the account to credential access attacks. for cases in which user accounts cannot be avoided, microsoft provides the group managed service accounts (gmsa) feature, which ensures that the account password is robust and changed regularly and automatically.

Techniques

• T1098

Sample rules

Account Configured with Never-Expiring Password

• source: elastic
• technicques:
  • T1098

Description

Detects the creation and modification of an account with the “Don’t Expire Password” option Enabled. Attackers can abuse this misconfiguration to persist in the domain and maintain long-term access using compromised accounts with this property.

Detection logic

event.action:"modified-user-account" and winlog.api:"wineventlog" and event.code:"4738" and
  message:"'Don't Expire Password' - Enabled" and not user.id:"S-1-5-18"