Windows Security: Detect Computer Added or Removed from Domain Controller

title: "Windows Security: Detect Computer Added or Removed from Domain Controller"
id: 2816989b-6aff-4b58-bc07-d2a9d7e73316
status: test
description: This rule flags Windows Security events indicating a computer object was added or removed, using Event ID 4741 (computer account created) and 4743 (computer account deleted). Attackers may manipulate directory objects to establish or remove machine identities during domain compromise, including scenarios where new SPNs are introduced via computer account creation. It relies on Security log telemetry from Windows that records these directory service account management events.
references:
  - https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4741
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4743
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_add_remove_computer.yml
author: frack113, Huntrule Team
date: 2022-10-14
tags:
  - attack.defense-impairment
  - attack.t1207
logsource:
  service: security
  product: windows
detection:
  selection:
    EventID:
      - 4741
      - 4743
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 20d96d95-5a20-4cf1-a483-f3bda8a7c037
    type: derived