topic Re: How to create use case that would detect when Admin Password Modified/Changed? in Monitoring Splunk

How to create use case that would detect when admin password modified/changed?

DanAlexander — Fri, 10 Jun 2022 19:55:49 GMT

Hi All,

I need to create a Use Case that would detect Admin user/s changing their own password.

So far I have:

index=XXX EventCode=4724

| where user=src_user AND src_user_category="privileged" AND user_category="privileged"

not sure how to go around as this is not doing the search I want.

Any help much appreciated!

Thanks all

Re: How to create use case that would detect when Admin Password Modified/Changed?

richgalloway — Fri, 10 Jun 2022 19:35:34 GMT

Please explain what is meant by "not doing the search I want". What do you want and what do you get?

My WinEventLog doesn't have the user_category and src_user_category fields. Are you sure yours does? In the past, I've had to detect admin accounts based on a naming convention. For example:

index=wineventlog EventCode=4724 user!="*$" user="adm_*" | where user=src_user