Sunturai
Back to results
InformationalSplunk security contentRaven Tait +1

Windows Suspicious Burst of Password Changes

A regular user account performed rapid, repeated password changes across multiple local accounts within a 2-second window. This pattern is consistent with automated credential manipulation tools that cycle account…

Description

A regular user account performed rapid, repeated password changes across multiple local accounts within a 2-second window. This pattern is consistent with automated credential manipulation tools that cycle account passwords to deny access to defenders or escalate privileges The speed and volume of changes indicates scripted or tooled activity rather than manual administration, as legitimate password resets do not occur at machine speed across multiple accounts simultaneously.

Detection logic

Detection requirements

Platform
ContainersLinuxmacOSWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
windows_event_log_security_4723windows_event_log_security_4724

Known benign triggers

  • Service accounts may be responsible for the creation, deletion or modification of accounts for legitimate purposes. Filter as needed.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice