Active Directory Object Creation (18b236d8-7224-488f-9d2f-50076a0f653a)
Creating new objects in AD, such as user accounts, groups, organizational units (OUs), or trust relationships. Logged as Event ID 5137. Examples:
- User Account Creation: New user account.
- Group Creation: New security/distribution group.
- OU Creation: New organizational unit.
- Service Account Creation: New service account for automation or malicious tasks.
- Trust Object Creation: Trust relationship with another domain.
Data Collection Measures:
- Audit Policy:
- Enable "Audit Directory Service Changes" (Success and Failure).
- Path:
Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Directory Service Changes. - Key Event: Event ID 5137 (object creation).
- Log Forwarding: Use WEF to centralize logs for SIEM tools (e.g., Splunk).
- Enable EDR Monitoring:
- Track processes that create new accounts or modify AD objects.
- Correlate object creation with suspicious commands (e.g., net user /add).