Windows Event ID 4781 – Security: Account Name Changed

Start by examining the specific Event 4781 details to understand the account change context.

1. Open Event Viewer → Windows Logs → Security
2. Filter for Event ID 4781 using the filter option in the Actions pane
3. Double-click the event to view detailed information including:
   • Old Account Name: Original sAMAccountName
   • New Account Name: Modified sAMAccountName
   • Account Domain: Domain or computer name
   • Subject: User who performed the change
   • Logon ID: Session identifier for correlation
4. Note the timestamp and correlate with any scheduled maintenance windows
5. Check if the change aligns with documented administrative procedures

Use PowerShell to efficiently search and analyze Event 4781 occurrences across multiple systems.

1. Query recent account name changes on the local system:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4781} -MaxEvents 50 | Select-Object TimeCreated, @{Name='OldName';Expression={($_.Message -split '\n' | Where-Object {$_ -match 'Old Account Name:'}) -replace '.*Old Account Name:\s*',''}}, @{Name='NewName';Expression={($_.Message -split '\n' | Where-Object {$_ -match 'New Account Name:'}) -replace '.*New Account Name:\s*',''}}

2. Search for specific account name changes:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4781} | Where-Object {$_.Message -match 'testuser'} | Format-Table TimeCreated, Id, LevelDisplayName

3. Query domain controllers for AD account changes:

   $DCs = Get-ADDomainController -Filter *
   foreach ($DC in $DCs) {
       Invoke-Command -ComputerName $DC.HostName -ScriptBlock {
           Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4781} -MaxEvents 10
       }
   }

4. Export results for further analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4781} | Export-Csv -Path "C:\Temp\AccountNameChanges.csv" -NoTypeInformation

Analyze patterns in account name changes to identify potential security issues or administrative trends.

1. Check for suspicious timing patterns:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4781} | Group-Object @{Expression={$_.TimeCreated.Hour}} | Sort-Object Count -Descending

2. Identify users frequently changing account names:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4781} | ForEach-Object {
       $Subject = ($_.Message -split '\n' | Where-Object {$_ -match 'Subject:'} | Select-Object -First 1) -replace '.*Account Name:\s*',''
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           ChangedBy = $Subject
           Message = $_.Message
       }
   } | Group-Object ChangedBy | Sort-Object Count -Descending

3. Cross-reference with logon events (4624) to verify legitimate sessions:

   $LogonEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624}
   $NameChangeEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4781}
   # Correlate by Logon ID and timestamp

4. Check Active Directory for additional account modifications:

   Get-ADUser -Filter * -Properties whenChanged, whenCreated | Where-Object {$_.whenChanged -gt (Get-Date).AddDays(-7)} | Select-Object Name, SamAccountName, whenChanged

Set up comprehensive monitoring for account name changes to improve security posture and compliance.

1. Verify audit policy configuration:

   auditpol /get /subcategory:"User Account Management"

2. Enable detailed auditing if not already configured:

   auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable

3. Create a scheduled task to monitor for Event 4781:

   $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-Command Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4781} -MaxEvents 1 | Send-MailMessage -To 'admin@company.com' -From 'monitoring@company.com' -Subject 'Account Name Changed' -SmtpServer 'mail.company.com'"
   $Trigger = New-ScheduledTaskTrigger -AtStartup
   $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries
   Register-ScheduledTask -TaskName "Monitor-AccountNameChanges" -Action $Action -Trigger $Trigger -Settings $Settings

4. Configure Windows Event Forwarding for centralized collection:
   • On collector server: wecutil qc
   • Create subscription: wecutil cs subscription.xml
   • Configure source computers to forward Security events
5. Set up SIEM integration using Windows Event Log forwarding or agents

Conduct thorough forensic analysis when suspicious account name changes are detected.

1. Preserve evidence by exporting relevant event logs:

   wevtutil epl Security C:\Forensics\Security_$(Get-Date -Format 'yyyyMMdd_HHmmss').evtx

2. Analyze the complete timeline around the account change:

   $StartTime = (Get-Date).AddHours(-2)
   $EndTime = (Get-Date).AddHours(2)
   Get-WinEvent -FilterHashtable @{LogName='Security'; StartTime=$StartTime; EndTime=$EndTime} | Where-Object {$_.Id -in @(4624,4625,4648,4672,4781)} | Sort-Object TimeCreated

3. Check for related registry modifications:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4657} | Where-Object {$_.Message -match 'SAM\\SAM\\Domains'}

4. Examine process creation events around the time of change:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} | Where-Object {$_.TimeCreated -gt $StartTime -and $_.TimeCreated -lt $EndTime} | Select-Object TimeCreated, @{Name='Process';Expression={($_.Message -split '\n' | Where-Object {$_ -match 'New Process Name:'}) -replace '.*New Process Name:\s*',''}}

5. Document findings and implement containment measures if malicious activity is confirmed:
   • Reset passwords for affected accounts
   • Review and revoke unnecessary administrative privileges
   • Update security policies and monitoring rules
   • Conduct additional system scans for indicators of compromise