AD account with Don't Expire Password

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Content Index


Identifies whenever a user account has the setting "Password Never Expires" in the user account properties selected. This is indicated in Security event 4738 in the EventData item labeled UserAccountControl with an included value of %%2089. %%2089 resolves to "Don't Expire Password - Enabled".

Attribute Value
Type Analytic Rule
Solution Standalone Content
ID 6c360107-f3ee-4b91-9f43-f4cfd90441cf
Severity Low
Kind Scheduled
Tactics Persistence
Techniques T1098
Required Connectors SecurityEvents, WindowsSecurityEvents, WindowsForwardedEvents
Source View on GitHub

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Analytic Rules