title: Possible Remote Password Change Through SAMR
id: 7818b381-5eb1-4641-bea5-ef9e4cfb5951
status: test
description: Detects a possible remote NTLM hash change through SAMR API SamiChangePasswordUser() or SamSetInformationUser(). "Audit User Account Management" in "Advanced Audit Policy Configuration" has to be enabled in your local security policy / GPO to see this events.
author: Dimitrios Slamaris
date: 2017/06/09
modified: 2021/11/27
logsource:
  product: windows
  service: security
detection:
  samrpipe:
    EventID: 5145
    RelativeTargetName: samr
  passwordchanged:
    EventID: 4738
  passwordchanged_filter:
    PasswordLastSet:
  timeframe: 15s
  condition: ( passwordchanged and not passwordchanged_filter ) | near samrpipe
level: medium
tags:
  - attack.credential_access
  - attack.t1212
