Rapid Local Administrator Password Manipulation
Detects rapid password change (Event ID 4724) or attempt (Event ID 4723) events on local administrator accounts within a short timeframe. This behavior is indicative of the BlueHammer zero-day local privilege escalation (LPE), where an attacker temporarily overwrites a local admin's password to spawn a SYSTEM shell and immediately restores the original hash to evade detection.
Sigma
