Sunturai
Back to results
MediumSplunk security contentRaven Tait +1

Windows Computer Account Changed to Domain Controller

Detects a modification to the User Account Control flags for a computer account where the `SERVER_TRUST_ACCOUNT` flag is set. This flag is normally associated with domain controller computer accounts. This activity…

Description

Detects a modification to the User Account Control flags for a computer account where the `SERVER_TRUST_ACCOUNT` flag is set. This flag is normally associated with domain controller computer accounts. This activity may indicate a legitimate domain controller promotion or, if unexpected, an attempt to grant a computer account domain controller-like trust within Active Directory.

Detection logic

Detection requirements

Platform
LinuxmacOSWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
windows_event_log_security_4742

Known benign triggers

  • Some legitimate administrative activities during domain controller promotions or system updates may trigger this rule. Filter alerts originating from authorized IT personnel or approved change management processes.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice