Account Configured with Never-Expiring Password
Detects the creation and modification of an account with the "Don't Expire Password" option Enabled. Attackers can abuse this misconfiguration to persist in the domain and maintain long-term access using compromised accounts with this property.
Elastic rule (View on GitHub)
1[metadata]
2creation_date = "2022/02/22"
3integration = ["system", "windows"]
4maturity = "production"
5updated_date = "2024/08/07"
6
7[rule]
8author = ["Elastic"]
9description = """
10Detects the creation and modification of an account with the "Don't Expire Password" option Enabled. Attackers can abuse
11this misconfiguration to persist in the domain and maintain long-term access using compromised accounts with this
12property.
13"""
14false_positives = [
15 """
16 User accounts can be used as service accounts and have their password set never to expire. This is a bad security
17 practice that exposes the account to Credential Access attacks. For cases in which user accounts cannot be avoided,
18 Microsoft provides the Group Managed Service Accounts (gMSA) feature, which ensures that the account password is
19 robust and changed regularly and automatically.
20 """,
21]
22from = "now-9m"
23index = ["winlogbeat-*", "logs-system.*", "logs-windows.*"]
24language = "kuery"
25license = "Elastic License v2"
26name = "Account Configured with Never-Expiring Password"
27note = """## Triage and analysis
28
29### Investigating Account Configured with Never-Expiring Password
30
31Active Directory provides a setting that prevents users' passwords from expiring. Enabling this setting is bad practice and can expose environments to vulnerabilities that weaken security posture, especially when these accounts are privileged.
32
33The setting is usually configured so a user account can act as a service account. Attackers can abuse these accounts to persist in the domain and maintain long-term access using compromised accounts with a never-expiring password set.
34
35#### Possible investigation steps
36
37- Identify the user account that performed the action and whether it should perform this kind of action.
38- Contact the account owner and confirm whether they are aware of this activity.
39- Investigate other alerts associated with the user/source host during the past 48 hours.
40- Inspect the account for suspicious or abnormal behaviors in the alert timeframe.
41
42### False positive analysis
43
44- This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.
45- Using user accounts as service accounts is a bad security practice and should not be allowed in the domain. The security team should map and monitor potential benign true positives (B-TPs), especially if the account is privileged. For cases in which user accounts cannot be avoided, Microsoft provides the Group Managed Service Accounts (gMSA) feature, which ensures that the account password is robust and changed regularly and automatically.
46
47### Response and remediation
48
49- Initiate the incident response process based on the outcome of the triage.
50- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
51- Reset the password of the account and update its password settings.
52- Search for other occurrences on the domain.
53 - Using the [Active Directory PowerShell module](https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser):
54 - `get-aduser -filter { passwordNeverExpires -eq $true -and enabled -eq $true } | ft`
55- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
56- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
57"""
58references = [
59 "https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire",
60 "http://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html",
61]
62risk_score = 47
63rule_id = "62a70f6f-3c37-43df-a556-f64fa475fba2"
64severity = "medium"
65tags = [
66 "Domain: Endpoint",
67 "OS: Windows",
68 "Use Case: Threat Detection",
69 "Tactic: Persistence",
70 "Data Source: Active Directory",
71 "Resources: Investigation Guide",
72 "Use Case: Active Directory Monitoring",
73 "Data Source: System",
74]
75timestamp_override = "event.ingested"
76type = "query"
77
78query = '''
79event.action:"modified-user-account" and winlog.api:"wineventlog" and event.code:"4738" and
80 message:"'Don't Expire Password' - Enabled" and not user.id:"S-1-5-18"
81'''
82
83
84[[rule.threat]]
85framework = "MITRE ATT&CK"
86[[rule.threat.technique]]
87id = "T1098"
88name = "Account Manipulation"
89reference = "https://attack.mitre.org/techniques/T1098/"
90
91
92[rule.threat.tactic]
93id = "TA0003"
94name = "Persistence"
95reference = "https://attack.mitre.org/tactics/TA0003/"
Triage and analysis
Investigating Account Configured with Never-Expiring Password
Active Directory provides a setting that prevents users' passwords from expiring. Enabling this setting is bad practice and can expose environments to vulnerabilities that weaken security posture, especially when these accounts are privileged.
The setting is usually configured so a user account can act as a service account. Attackers can abuse these accounts to persist in the domain and maintain long-term access using compromised accounts with a never-expiring password set.
Possible investigation steps
- Identify the user account that performed the action and whether it should perform this kind of action.
- Contact the account owner and confirm whether they are aware of this activity.
- Investigate other alerts associated with the user/source host during the past 48 hours.
- Inspect the account for suspicious or abnormal behaviors in the alert timeframe.
False positive analysis
- This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.
- Using user accounts as service accounts is a bad security practice and should not be allowed in the domain. The security team should map and monitor potential benign true positives (B-TPs), especially if the account is privileged. For cases in which user accounts cannot be avoided, Microsoft provides the Group Managed Service Accounts (gMSA) feature, which ensures that the account password is robust and changed regularly and automatically.
Response and remediation
- Initiate the incident response process based on the outcome of the triage.
- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
- Reset the password of the account and update its password settings.
- Search for other occurrences on the domain.
- Using the Active Directory PowerShell module:
get-aduser -filter { passwordNeverExpires -eq $true -and enabled -eq $true } | ft
- Using the Active Directory PowerShell module:
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
References
Related rules
- AdminSDHolder SDProp Exclusion Added
- Sensitive Privilege SeEnableDelegationPrivilege assigned to a User
- User Added to Privileged Group
- Active Directory Group Modification by SYSTEM
- AdminSDHolder Backdoor