Active Directory Object Creation

Creating new objects in AD, such as user accounts, groups, organizational units (OUs), or trust relationships. Logged as Event ID 5137. Examples:

• User Account Creation: New user account.
• Group Creation: New security/distribution group.
• OU Creation: New organizational unit.
• Service Account Creation: New service account for automation or malicious tasks.
• Trust Object Creation: Trust relationship with another domain.

Data Collection Measures:

• Audit Policy:
  • Enable "Audit Directory Service Changes" (Success and Failure).
  • Path: Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Directory Service Changes.
  • Key Event: Event ID 5137 (object creation).
• Log Forwarding: Use WEF to centralize logs for SIEM tools (e.g., Splunk).
• Enable EDR Monitoring:
  • Track processes that create new accounts or modify AD objects.
  • Correlate object creation with suspicious commands (e.g., net user /add).