Author: Gabriele Zambelli @gazambelli
Description: A computer account was created
EventId: 4741
Channel: Security
Provider: Microsoft-Windows-Security-Auditing
Maps:
  -
    Property: UserName
    PropertyValue: "%SubjectDomainName%\\%SubjectUserName%"
    Values:
      -
        Name: SubjectUserName
        Value: "/Event/EventData/Data[@Name=\"SubjectUserName\"]"
      -
        Name: SubjectDomainName
        Value: "/Event/EventData/Data[@Name=\"SubjectDomainName\"]"
  -
    Property: PayloadData1
    PropertyValue: "Target: %TargetDomainName%\\%TargetUserName% (%TargetSid%)"
    Values:
      -
        Name: TargetDomainName
        Value: "/Event/EventData/Data[@Name=\"TargetDomainName\"]"
      -
        Name: TargetUserName
        Value: "/Event/EventData/Data[@Name=\"TargetUserName\"]"
      -
        Name: TargetSid
        Value: "/Event/EventData/Data[@Name=\"TargetSid\"]"
  -
    Property: PayloadData2
    PropertyValue: "PasswordLastSet: %PasswordLastSet%"
    Values:
      -
        Name: PasswordLastSet
        Value: "/Event/EventData/Data[@Name=\"PasswordLastSet\"]"
  -
    Property: PayloadData3
    PropertyValue: "LogonID: %SubjectLogonId%"
    Values:
      -
        Name: SubjectLogonId
        Value: "/Event/EventData/Data[@Name=\"SubjectLogonId\"]"
  -
    Property: PayloadData4
    PropertyValue: "PrimaryGroupId: %PrimaryGroupId%"
    Values:
      -
        Name: PrimaryGroupId
        Value: "/Event/EventData/Data[@Name=\"PrimaryGroupId\"]"
  -
    Property: PayloadData5
    PropertyValue: "DnsHostName: %DnsHostName%"
    Values:
      -
        Name: DnsHostName
        Value: "/Event/EventData/Data[@Name=\"DnsHostName\"]"

Lookups:
  -
    Name: PrimaryGroupId
    Default: Unknown code
    Values:
      515: Domain Computers
      516: Domain Controllers
      521: Read-only Domain Controllers


# Documentation:
# Windows Events Attack Samples: https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES
# https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4741
# https://github.com/nasbench/EVTX-ETW-Resources/blob/main/ETWProvidersCSVs/Internal/Microsoft-Windows-Security-Auditing.csv
#
# Example Event Data:
# <Event>
#   <System>
#     <Provider Name="Microsoft-Windows-Security-Auditing" Guid="54849625-5478-4994-a5ba-3e3b0328c30d" />
#     <EventID>4741</EventID>
#     <Version>0</Version>
#     <Level>0</Level>
#     <Task>13825</Task>
#     <Opcode>0</Opcode>
#     <Keywords>0x8020000000000000</Keywords>
#     <TimeCreated SystemTime="2021-12-12 17:57:52.3136732" />
#     <EventRecordID>2982085</EventRecordID>
#     <Correlation />
#     <Execution ProcessID="624" ThreadID="3652" />
#     <Channel>Security</Channel>
#     <Computer>01566s-win16-ir.threebeesco.com</Computer>
#     <Security />
#   </System>
#   <EventData>
#     <Data Name="TargetUserName">DC012$</Data>
#     <Data Name="TargetDomainName">3B</Data>
#     <Data Name="TargetSid">S-1-5-21-308926384-506822093-3341789130-220105</Data>
#     <Data Name="SubjectUserSid">S-1-5-21-308926384-506822093-3341789130-101606</Data>
#     <Data Name="SubjectUserName">lgrove</Data>
#     <Data Name="SubjectDomainName">3B</Data>
#     <Data Name="SubjectLogonId">0x738AE4</Data>
#     <Data Name="PrivilegeList">-</Data>
#     <Data Name="SamAccountName">DC012$</Data>
#     <Data Name="DisplayName">-</Data>
#     <Data Name="UserPrincipalName">-</Data>
#     <Data Name="HomeDirectory">-</Data>
#     <Data Name="HomePath">-</Data>
#     <Data Name="ScriptPath">-</Data>
#     <Data Name="ProfilePath">-</Data>
#     <Data Name="UserWorkstations">-</Data>
#     <Data Name="PasswordLastSet">12/12/2021 9:57:52 AM</Data>
#     <Data Name="AccountExpires">%%1794</Data>
#     <Data Name="PrimaryGroupId">515</Data>
#     <Data Name="AllowedToDelegateTo">-</Data>
#     <Data Name="OldUacValue">0x0</Data>
#     <Data Name="NewUacValue">0x80</Data>
#     <Data Name="UserAccountControl">, %%2087</Data>
#     <Data Name="UserParameters">-</Data>
#     <Data Name="SidHistory">-</Data>
#     <Data Name="LogonHours">%%1793</Data>
#     <Data Name="DnsHostName">DC012.threebeesco.com</Data>
#     <Data Name="ServicePrincipalNames">, HOST/DC012.threebeesco.com, RestrictedKrbHost/DC012.threebeesco.com, HOST/DC012, RestrictedKrbHost/DC012</Data>
#   </EventData>
# </Event>
