Securing the Service Desk: Defending Against Social Engineering and Identity Takeover

---
title: Potential Service Desk Abuse - Privileged Account Reset
id: 8a4f2c91-1d3e-4b5a-9c7d-1e2f3a4b5c6d
status: experimental
description: Detects password resets performed on privileged domain admin groups by potential helpdesk users.
references:
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1078.002
logsource:
  product: windows
  category: user_management
detection:
  selection_target:
    TargetUserName|contains:
      - 'Admin'
      - 'svc_'
      - 'krbtgt'
  selection_operator:
    SubjectUserName|contains:
      - 'Helpdesk'
      - 'Support'
      - 'ServiceDesk'
  condition: all of selection_*
falsepositives:
  - Legitimate administrative emergency recovery
level: high
---
title: Suspicious Password Reset via Helpdesk Tooling
id: 9b5g3d02-2e4f-5c6b-0d8e-2f3a4b5c6d7e
status: experimental
description: Detects usage of Active Directory Users and Computers (ADUC) or RSAT tools specifically for password reset actions by non-administrative accounts.
references:
  - https://attack.mitre.org/techniques/T1098/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1098.004
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    Image|endswith:
      - '\dsacls.exe'
      - '\dsmod.exe'
      - '\mmc.exe'
  selection_cli:
    CommandLine|contains:
      - 'reset password'
      - 'pwd'
  filter_admin:
    SubjectUserName|contains:
      - 'Administrator'
      - 'Domain Admin'
  condition: selection_img and selection_cli and not filter_admin
falsepositives:
  - Legitimate delegated administration tasks
level: medium

// Hunt for privileged password resets initiated by Helpdesk staff
IdentityInfo
| join kind=inner (AuditLogs
| where OperationName in ("Reset user password", "Change user password", "Strong authentication update details")
| extend InitiatedBy = tostring(InitiatedBy.user.userPrincipalName), TargetUser = tostring(TargetResources[0].userPrincipalName)
| project TimeGenerated, OperationName, InitiatedBy, TargetUser, Result
) on $left.UserPrincipalName == $right.InitiatedBy
| where AssignedRoles has "Helpdesk" or AssignedRoles has "Tier 1"
| where TargetUser has "Admin" or TargetUser has "svc_"
| project TimeGenerated, InitiatedBy, TargetUser, OperationName, Result
| order by TimeGenerated desc

-- Hunt for Event ID 4724 (Password Reset) on Domain Controllers
SELECT System.TimeCreated as Timestamp,
       SubjectUserName as Initiator,
       TargetUserName as TargetAccount,
       TargetDomainName as Domain
FROM windows_evtx(filename='C:\\Windows\\System32\\winevt\\Logs\\Security.evtx')
WHERE EventID = 4724
  AND SubjectUserName =~ 'Helpdesk' OR SubjectUserName =~ 'Support'
  AND TargetUserName =~ 'Admin'

<#
.SYNOPSIS
    Audits Group Membership for Service Delegation Rights.
.DESCRIPTION
    Checks for non-admin users who have rights to reset passwords on high-privileged groups.
#>

Import-Module ActiveDirectory

$PrivilegedGroups = @("Domain Admins", "Enterprise Admins", "Administrators", "Schema Admins")
$Report = @()

foreach ($Group in $PrivilegedGroups) {
    try {
        $GroupMembers = Get-ADGroupMember -Identity $Group -Recursive
        foreach ($Member in $GroupMembers) {
            # Check who has 'Reset Password' permission on this user object
            $ADObject = Get-ADObject -Identity $Member.DistinguishedName -Properties ntSecurityDescriptor
            $AccessRules = $ADObject.ntSecurityDescriptor.GetAccessRules($true, $true, [System.Security.Principal.NTAccount])
            
            foreach ($Rule in $AccessRules) {
                if ($Rule.AccessControlType -eq "Allow" -and $Rule.ActiveDirectoryRights -match "ResetPassword") {
                    $IdentityRef = $Rule.IdentityReference.Value
                    $Report += [PSCustomObject]@{
                        TargetUser = $Member.Name
                        TargetOU  = $Member.DistinguishedName
                        AuthorizedIdentity = $IdentityRef
                        Right = "ExtendedRight - Reset Password"
                    }
                }
            }
        }
    }
    catch {
        Write-Warning "Could not process group: $Group"
    }
}

if ($Report) {
    $Report | Format-Table -AutoSize
    Write-Host "CRITICAL: Non-standard reset permissions found." -ForegroundColor Red
} else {
    Write-Host "No excessive reset permissions detected on privileged accounts." -ForegroundColor Green
}