Windows Security 4794: DSRM (Directory Services Restore Mode) Account Password Change

Flags potential changes to the DSRM administrator password on Windows domain controllers using Security EventID 4794.

FreeUnreviewedSigmahighv1

windows-security-4794-dsrm-directory-services-restore-mode-account-password-chan-53ad8e36

title: "Windows Security 4794: DSRM (Directory Services Restore Mode) Account Password Change"
id: 8b223f3e-f4bf-483d-83fa-4f853fc5747f
related:
  - id: b61e87c0-50db-4b2e-8986-6a2be94b33b0
    type: similar
  - id: 53ad8e36-f573-46bf-97e4-15ba5bf4bb51
    type: derived
status: stable
description: This rule identifies Windows Security events (EventID 4794) indicating a password was changed for the Directory Services Restore Mode (DSRM) administrator account on a domain controller. Changing the DSRM password can help an attacker maintain access by ensuring they can regain privileged control of the directory service during restore operations. It relies on Security log telemetry capturing EventID 4794.
references:
  - https://adsecurity.org/?p=1714
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4794
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_dsrm_password_change.yml
author: Thomas Patzke, Huntrule Team
date: 2017-02-19
modified: 2020-08-23
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1098
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4794
  condition: selection
falsepositives:
  - Initial installation of a domain controller.
level: high
license: DRL-1.1

What it detects

This rule identifies Windows Security events (EventID 4794) indicating a password was changed for the Directory Services Restore Mode (DSRM) administrator account on a domain controller. Changing the DSRM password can help an attacker maintain access by ensuring they can regain privileged control of the directory service during restore operations. It relies on Security log telemetry capturing EventID 4794.

Known false positives

Initial installation of a domain controller.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.