Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000129

AD object created by unusual Initiator

Medium
Active Directory
Credential Access Defense Evasion Execution Lateral Movement
v26

Signature Identity

CTD-000129
Threat ID
26
Version
IOC
Indicator Type

Threat Description

Anomalous account creation can indicate a potential security issue, especially when accounts are created outside of expected processes. Alerts are triggered when account creation records are detected that were not made by a known initiator with more than two weeks of inactivity. Note that after two weeks of inactivity, any inactive known initiators are removed from the “known initiators” list.

NOTE: This threat rule includes a built-in lookback parameter set to 12 hours. Only events that occurred within this timeframe are processed by the rule.

MITRE ATT&CK: Attack Tactics

Credential Access Defense Evasion Execution Lateral Movement

D3FEND: Defend Tactics

Domain accounts monitoring

Remediation

Review Change History for any suspicious activity of the initiator or created object. Use rollback to undo unwanted changes. Consider changing the password of the initiator account.

To change the password for a user account in Active Directory, perform these steps:

  1. Log on to the domain controller with administrator rights.
  2. Click Start.
  3. Click Control Panel.
  4. Double-click Administrative Tools.
  5. Double-click Active Directory Users and Computers.
  6. Navigate to the Users item of your Active Directory domain in the left pane.
  7. Right-click the domain user account you want to reset the password for in the right pane.
  8. Select Reset Password.
  9. Type a new password into the Password and Confirm Password boxes.
  10. Click OK.

Frequently Asked Questions

What does AD object created by unusual Initiator mean?

An Active Directory object is created by an initiator that lacks the necessary permissions or credentials to perform the action. This can occur when a user or process attempts to create an account using an untrusted or unknown identity.

Anomalous account creation indicates a potential security issue, allowing attackers to potentially exploit the object for further malicious activity. It warrants investigation to determine the cause and prevent future unauthorized access.

Attackers may use an AD object created by an unusual initiator as a potential entry point for privilege escalation, information gathering, or lateral movement within the network. This can lead to increased attacker capability and persistence.

Cayosoft Guardian detects AD object created by unusual Initiator by monitoring account creation records in Active Directory, identifying instances where the initiator lacks necessary permissions or credentials, and flagging them for administrator review.

Cayosoft Guardian helps reduce the risk of AD object created by unusual Initiator by providing visibility into account creation activity, supporting investigation and remediation efforts, and assisting administrators in reviewing Change History for suspicious activity.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
Active Directory
Themes
Account protection
Attack Tactics
Credential Access Defense Evasion Execution Lateral Movement
Defend Tactics
Domain accounts monitoring
Indicator Types
IOC
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical