Event ID 4782 - The password hash an account was accessed

Event ID 4782 - The password hash an account was accessed

Log Sample

{
 "EventTime": "2017/11/17 04:04:12"
 "Hostname": "WIN-AE4MOB56I4P.changeme.com"
 "Keywords": -9214364837600034816
 "EventType": "AUDIT_SUCCESS"
 "SeverityValue": 2
 "Severity": "INFO"
 "EventID": 4782
 "SourceName": "Microsoft-Windows-Security-Auditing"
 "ProviderGuid": "{54849625-5478-4994-A5BA-3E3B0328C30D}"
 "Version": 0
 "Task": 13827
 "OpcodeValue": 0
 "RecordNumber": 2034819
 "ProcessID": 776
 "ThreadID": 2032
 "Channel": "Security"
 "Message": "The password hash an account was accessed."
 "Category": "Audit Other Account Management Events"
 "TargetUserName": "Alice"
 "TargetDomainName": "changeme"
 "SubjectUserSid": "S-1-5-21-924791265-3775684568-2843720401-500"
 "SubjectUserName": "Administrator"
 "SubjectDomainName": "changeme"
 "SubjectLogonId": "0x33903e"
 "EventReceivedTime": "2017/11/17 04:04:12"
 "SourceModuleName": "in"
 "SourceModuleType": "im_msvistalog"
}

General Description

• This event generates on domain controllers during password migration of an account using Active Directory Migration Toolkit.
• Typically “Subject\Security ID” is the SYSTEM account.

SIEM: Security Consideration

• Any actions with account’s password hashes should be planned. If this action was not planned, investigate the reason for the change

Detail Description

Subject:

• SubjectUserSID: SID of account that requested the “create Computer object” operation. 
• SubjectUserName: the name of the account that requested the “create Computer object” operation.
• SubjectDomainName: subject’s domain name. Formats vary, and include the following:

Domain NETBIOS name example: CONTOSO

Lowercase full domain name: contoso.local

Uppercase full domain name: CONTOSO.LOCAL

For some well-known security principals, such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.

• SubjectLogon ID: hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, “4624: An account was successfully logged on.”

Target:

• TargetUserName: the name of the computer account that was created. For example: WIN81$
• TargetDomainName: domain name of created computer account. Formats vary, and include the following:

Domain NETBIOS name example: CONTOSO

Lowercase full domain name: contoso.local

Uppercase full domain name: CONTOSO.LOCAL