Account Configured with Never-Expiring Password

 1[metadata]
 2creation_date = "2022/02/22"
 3integration = ["system", "windows"]
 4maturity = "production"
 5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 6min_stack_version = "8.3.0"
 7updated_date = "2023/06/22"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Detects the creation and modification of an account with the "Don't Expire Password" option Enabled. Attackers can abuse
13this misconfiguration to persist in the domain and maintain long-term access using compromised accounts with this
14property.
15"""
16false_positives = [
17    """
18    User accounts can be used as service accounts and have their password set never to expire. This is a bad security
19    practice that exposes the account to Credential Access attacks. For cases in which user accounts cannot be avoided,
20    Microsoft provides the Group Managed Service Accounts (gMSA) feature, which ensures that the account password is
21    robust and changed regularly and automatically.
22    """,
23]
24from = "now-9m"
25index = ["winlogbeat-*", "logs-system.*", "logs-windows.*"]
26language = "kuery"
27license = "Elastic License v2"
28name = "Account Configured with Never-Expiring Password"
29note = """## Triage and analysis
30
31### Investigating Account Configured with Never-Expiring Password
32
33Active Directory provides a setting that prevents users' passwords from expiring. Enabling this setting is bad practice and can expose environments to vulnerabilities that weaken security posture, especially when these accounts are privileged.
34
35The setting is usually configured so a user account can act as a service account. Attackers can abuse these accounts to persist in the domain and maintain long-term access using compromised accounts with a never-expiring password set.
36
37#### Possible investigation steps
38
39- Identify the user account that performed the action and whether it should perform this kind of action.
40- Contact the account owner and confirm whether they are aware of this activity.
41- Investigate other alerts associated with the user/source host during the past 48 hours.
42- Inspect the account for suspicious or abnormal behaviors in the alert timeframe.
43
44### False positive analysis
45
46- This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.
47- Using user accounts as service accounts is a bad security practice and should not be allowed in the domain. The security team should map and monitor potential benign true positives (B-TPs), especially if the account is privileged. For cases in which user accounts cannot be avoided, Microsoft provides the Group Managed Service Accounts (gMSA) feature, which ensures that the account password is robust and changed regularly and automatically.
48
49### Response and remediation
50
51- Initiate the incident response process based on the outcome of the triage.
52- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
53- Reset the password of the account and update its password settings.
54- Search for other occurrences on the domain.
55    - Using the [Active Directory PowerShell module](https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser):
56        - `get-aduser -filter { passwordNeverExpires -eq $true  -and enabled -eq $true } | ft`
57- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
58- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
59"""
60references = [
61    "https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire",
62    "http://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html",
63]
64risk_score = 47
65rule_id = "62a70f6f-3c37-43df-a556-f64fa475fba2"
66severity = "medium"
67tags = [
68    "Domain: Endpoint",
69    "OS: Windows",
70    "Use Case: Threat Detection",
71    "Tactic: Persistence",
72    "Data Source: Active Directory",
73    "Resources: Investigation Guide",
74    "Use Case: Active Directory Monitoring"
75]
76timestamp_override = "event.ingested"
77type = "query"
78
79query = '''
80event.action:"modified-user-account" and winlog.api:"wineventlog" and event.code:"4738" and
81  message:"'Don't Expire Password' - Enabled" and not user.id:"S-1-5-18"
82'''
83
84
85[[rule.threat]]
86framework = "MITRE ATT&CK"
87[[rule.threat.technique]]
88id = "T1098"
89name = "Account Manipulation"
90reference = "https://attack.mitre.org/techniques/T1098/"
91
92
93[rule.threat.tactic]
94id = "TA0003"
95name = "Persistence"
96reference = "https://attack.mitre.org/tactics/TA0003/"