4720 - Account Creation

https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720

Event ID 4720 is a critical event in the Windows Security Event Log that signifies the creation of a user account. This event is part of the audit category related to user account management, which falls under the security auditing capabilities of Windows. Monitoring and analyzing this event is essential for security professionals to detect, investigate, and respond to unauthorized account creation, which can be an indicator of a security breach or insider threat.

The event is logged by the Security subsystem of Windows when the audit policy for "Audit User Account Management" is enabled, and a new user account is created on the system.

Category: Audit User Account Management

Significance:

• Security Implications: Unauthorized account creation is a common technique used by attackers to gain persistent access to a system or network, escalate privileges, or facilitate lateral movement.

• Compliance and Operational Integrity: Ensuring that only authorized accounts are created and exist within an environment is critical for compliance with various regulatory standards and maintaining operational integrity.

Details Included in Event ID 4720

• Subject: Information about the user or process that initiated the account creation, including the Security ID (SID), account name, domain name, and logon ID.

• New Account Information: Details about the newly created account, such as the Security ID, account name, domain, and attributes.

• Attributes: This includes additional properties of the created account like "User Principal Name", "Home Directory", "Home Drive", "Script Path", "Profile Path", etc., which provide further context about the account's intended use or configuration.

How to Use Event ID 4720 for Security

Detection and Alerting: Configuring security information and event management (SIEM) systems or other monitoring tools to alert on this event ID helps in early detection of potentially malicious activity.

Forensic Analysis: In the event of a security incident, forensic analysts can use this event to trace back unauthorized activities, understand the scope of an attack, or identify the method of compromise.

Account Management Audits: Regularly reviewing events related to account creation, modification, and deletion can help organizations enforce least privilege, ensure compliance, and detect signs of insider threats.

Best Practices for Monitoring Event ID 4720

• Enable Detailed Auditing: Ensure that "Audit User Account Management" is enabled in your Group Policy settings to capture events related to user account management activities.

• Regular Reviews: Incorporate the review of this event ID into regular security audits and monitoring routines.

• Contextual Analysis: Always analyze this event in conjunction with other events and logs. For example, correlating it with events indicating privilege assignment (e.g., Event ID 4728 - A member was added to a security-enabled global group) can provide insights into potential escalation of privileges.

• Alert Configuration: Configure alerts for unusual times (e.g., account creation outside of business hours) or high volumes of account creation events, which could indicate automated attacks or policy violations.

Limitations

While Event ID 4720 is a valuable indicator of account creation activities, it alone does not provide information on the legitimacy or authorization of the action. Additional context, correlation with other events, and understanding of the normal baseline are necessary for effective analysis.