Detectionlowtest

Add or Remove Computer from DC

Detects the creation or removal of a computer. Can be used to detect attacks such as DCShadow via the creation of a new SPN.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

François HubautCreated Fri Oct 1420d96d95-5a20-4cf1-a483-f3bda8a7c037windows

Log Source

Windowssecurity

ProductWindows← raw: windows

Servicesecurity← raw: security

Detection Logic

detection:
    selection:
        EventID:
            - 4741
            - 4743
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

Other

attack.t1207

Rule Metadata

Rule ID

20d96d95-5a20-4cf1-a483-f3bda8a7c037

Status

test

Level

low

Type

Detection

Created

Fri Oct 14

Author

Path

rules/windows/builtin/security/win_security_add_remove_computer.yml

Raw Tags

attack.defense-evasionattack.t1207