Sunturai
Back to results
MediumSplunk security contentRaven Tait +1

Windows Builtin Account Name Was Changed

The following analytic detects renaming of Windows built-in accounts via Event ID 4781. It identifies renames targeting accounts with well-known reserved RIDs (500-504): Administrator, Guest, krbtgt, DefaultAccount,…

Description

The following analytic detects renaming of Windows built-in accounts via Event ID 4781. It identifies renames targeting accounts with well-known reserved RIDs (500-504): Administrator, Guest, krbtgt, DefaultAccount, and WDAGUtilityAccount, by matching the TargetSid field against the S-1-5-21-*-50[0-4] pattern. Attackers commonly rename the built-in Administrator account to evade detections that alert on the literal account name, while retaining the full privileges of the RID-500 account. Renaming Guest, krbtgt, or other reserved accounts is highly unusual in any legitimate environment.

Detection logic

Detection requirements

Platform
ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows

The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.

Log source category
windows_event_log_security_4781

Known benign triggers

  • Renaming built-in accounts is uncommon in most environments but may occur during initial system hardening or CIS benchmark compliance efforts. Validate the source user, logon ID, and timing against expected change control windows before tuning.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice