Account Configured with Never-Expiring Password

edit

Detects the creation and modification of an account with the "Don’t Expire Password" option Enabled. Attackers can abuse this misconfiguration to persist in the domain and maintain long-term access using compromised accounts with this property.

Rule type: query

Rule indices:

  • winlogbeat-*
  • logs-system.*

Severity: medium

Risk score: 47

Runs every: 5 minutes

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Elastic
  • Host
  • Windows
  • Threat Detection
  • Persistence
  • Active Directory
  • Investigation Guide

Version: 102 (version history)

Added (Elastic Stack release): 8.2.0

Last modified (Elastic Stack release): 8.6.0

Rule authors: Elastic

Rule license: Elastic License v2

Potential false positives

edit

User accounts can be used as service accounts and have their password set never to expire. This is a bad security practice that exposes the account to Credential Access attacks. For cases in which user accounts cannot be avoided, Microsoft provides the Group Managed Service Accounts (gMSA) feature, which ensures that the account password is robust and changed regularly and automatically.

Investigation guide

edit
## Triage and analysis

### Investigating Account Configured with Never-Expiring Password

Active Directory provides a setting that prevents users' passwords from expiring. Enabling this setting is bad practice and can expose
environments to vulnerabilities that weaken security posture, especially when these accounts are privileged.

The setting is usually configured so a user account can act as a service account. Attackers can abuse these accounts to
persist in the domain and maintain long-term access using compromised accounts with a never-expiring password set.

#### Possible investigation steps

- Identify the user account that performed the action and whether it should perform this kind of action.
- Contact the account owner and confirm whether they are aware of this activity.
- Investigate other alerts associated with the user/source host during the past 48 hours.
- Inspect the account for suspicious or abnormal behaviors in the alert timeframe.

### False positive analysis

- This activity should not happen legitimately. The security team should address any potential benign true positive
(B-TP), as this configuration can put the user and the domain at risk.
- Using user accounts as service accounts is a bad security practice and should not be allowed in the domain. The
security team should map and monitor potential benign true positives (B-TPs), especially if the account is privileged.
For cases in which user accounts cannot be avoided, Microsoft provides the Group Managed Service Accounts (gMSA) feature,
which ensures that the account password is robust and changed regularly and automatically.

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
- Reset the password of the account and update its password settings.
- Search for other occurrences on the domain.
    - Using the [Active Directory PowerShell module](https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser):
        - `get-aduser -filter { passwordNeverExpires -eq $true  -and enabled -eq $true } | ft`
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts, if
any, are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email,
business systems, and web services.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
mean time to respond (MTTR).

Rule query

edit
event.action:"modified-user-account" and event.code:"4738" and
message:"'Don't Expire Password' - Enabled" and not user.id:"S-1-5-18"

Threat mapping

edit

Framework: MITRE ATT&CKTM

Rule version history

edit
Version 102 (8.6.0 release)
  • Formatting only
Version 101 (8.5.0 release)
  • Formatting only
Version 3 (8.4.0 release)
  • Formatting only
Version 2 (8.3.0 release)
  • Rule name changed from: Account configured with never Expiring Password