AD privileged account password reset or unlock

A password reset or account unlock for a privileged account can indicate a security incident when it occurs outside an approved change window, is performed by an unexpected initiator, or is not supported by an authorized change request. These actions can restore access to an account that was locked, disabled, or previously compromised.

If abused, a privileged reset/unlock can enable privilege escalation, credential abuse, and lateral movement. For example, an attacker with access to helpdesk workflows may reset a highly privileged account (such as a domain admin) and use the new credentials to access sensitive systems and make follow-on changes.

Threat actors are known to target service desk processes using social engineering to trigger unauthorized password resets and unlocks. Campaigns associated with groups such as Scattered Spider have specifically leveraged helpdesk interaction to obtain password resets (and related identity control changes) to facilitate account takeover.

NOTE: Cayosoft Guardian defines privileged users in Active Directory as users with adminCount=1. By design Active Directory uses this attribute to protect members of administrative groups.

According to security best practices it is not recommended re-using admin accounts, instead these accounts must be de-provisioned. If an account has administrative permissions, it might also obtain access to other resources using these administrative permissions and keep this access even after it is removed from the administrative groups. Learn more about AdminSdHolder and SDProp – Microsoft Community Hub.

NOTE: This threat rule includes a built-in lookback parameter set to 25 hours. Only events that occurred within this timeframe are processed by the rule.