Author: Andrew Rathbun
Description: An attempt was made to query the existence of a blank password for an account
EventId: 4797
Channel: Security
Provider: Microsoft-Windows-Security-Auditing
Maps:
  -
    Property: UserName
    PropertyValue: "%domain%\\%user% (%sid%)"
    Values:
      -
        Name: domain
        Value: "/Event/EventData/Data[@Name=\"SubjectDomainName\"]"
      -
        Name: user
        Value: "/Event/EventData/Data[@Name=\"SubjectUserName\"]"
      -
        Name: sid
        Value: "/Event/EventData/Data[@Name=\"SubjectUserSid\"]"
  -
    Property: PayloadData1
    PropertyValue: "Target: %TargetDomainName%\\%TargetUserName%"
    Values:
      -
        Name: TargetUserName
        Value: "/Event/EventData/Data[@Name=\"TargetUserName\"]"
      -
        Name: TargetDomainName
        Value: "/Event/EventData/Data[@Name=\"TargetDomainName\"]"
  -
    Property: PayloadData2
    PropertyValue: "SubjectLogonId: %SubjectLogonId%"
    Values:
      -
        Name: SubjectLogonId
        Value: "/Event/EventData/Data[@Name=\"SubjectLogonId\"]"
  -
    Property: PayloadData3
    PropertyValue: "Workstation: %Workstation%"
    Values:
      -
        Name: Workstation
        Value: "/Event/EventData/Data[@Name=\"Workstation\"]"

# Documentation:
# https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4797
# https://docs.microsoft.com/en-us/answers/questions/246751/what-condition-will-trigger-event-id-4797-an-attem.html
# https://github.com/nasbench/EVTX-ETW-Resources/blob/main/ETWProvidersCSVs/Internal/Microsoft-Windows-Security-Auditing.csv
#
# Example Event Data:
# <Event>
#   <System>
#     <Provider Name="Microsoft-Windows-Security-Auditing" Guid="54849625-5478-4994-a5ba-3e3b6798c30d" />
#     <EventID>4797</EventID>
#     <Version>0</Version>
#     <Level>0</Level>
#     <Task>13824</Task>
#     <Opcode>0</Opcode>
#     <Keywords>0x8020000000000000</Keywords>
#     <TimeCreated SystemTime="2021-07-21 08:38:40.5035194" />
#     <EventRecordID>2882305</EventRecordID>
#     <Correlation ActivityID="f5b29056-746c-0000-9990-b2f56c74d701" />
#     <Execution ProcessID="656" ThreadID="15220" />
#     <Channel>Security</Channel>
#     <Computer>HOSTNAME.domain</Computer>
#     <Security />
#   </System>
#   <EventData>
#     <Data Name="SubjectUserSid">S-1-5-21-12345678-12345678-112345678-1234</Data>
#     <Data Name="SubjectUserName">Username</Data>
#     <Data Name="SubjectDomainName">Domain</Data>
#     <Data Name="SubjectLogonId">0x32012CAF</Data>
#     <Data Name="Workstation">HOSTNAME</Data>
#     <Data Name="TargetUserName">Username</Data>
#     <Data Name="TargetDomainName">Domain</Data>
#   </EventData>
# </Event>
