SigmaHQ/rules/windows/builtin/win_user_creation.yml

title: Local User Creation
id: 66b6be3d-55d0-4f47-9855-d69df21740ea
description: Detects local user creation on windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your windows
    server logs and not on your DC logs.
status: experimental
tags:
    - attack.persistence
    - attack.t1136
references:
    - https://patrick-bareiss.com/detecting-local-user-creation-in-ad-with-sigma/
author: Patrick Bareiss
date: 2019/04/18
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4720
    condition: selection
fields:
    - EventCode
    - AccountName
    - AccountDomain
falsepositives:
    - Domain Controller Logs
    - Local accounts managed by privileged account management tools
level: low
fix: fixed casing and long rule titles 2020-01-30 16:26:09 +00:00			`title: Local User Creation`
Added UUIDs to rules 2019-11-12 22:12:27 +00:00			`id: 66b6be3d-55d0-4f47-9855-d69df21740ea`
			`description: Detects local user creation on windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your windows`
			`server logs and not on your DC logs.`
Modified rule * Adjusted ATT&CK tagging * Set status 2019-04-20 22:14:57 +00:00			`status: experimental`
New Sigma rule detecting local user creation 2019-04-18 17:59:43 +00:00			`tags:`
Modified rule * Adjusted ATT&CK tagging * Set status 2019-04-20 22:14:57 +00:00			`- attack.persistence`
			`- attack.t1136`
New Sigma rule detecting local user creation 2019-04-18 17:59:43 +00:00			`references:`
Added UUIDs to rules 2019-11-12 22:12:27 +00:00			`- https://patrick-bareiss.com/detecting-local-user-creation-in-ad-with-sigma/`
New Sigma rule detecting local user creation 2019-04-18 17:59:43 +00:00			`author: Patrick Bareiss`
fix: fixed missing date fields in remaining files 2020-01-30 15:07:37 +00:00			`date: 2019/04/18`
New Sigma rule detecting local user creation 2019-04-18 17:59:43 +00:00			`logsource:`
			`product: windows`
			`service: security`
			`detection:`
			`selection:`
			`EventID: 4720`
			`condition: selection`
			`fields:`
			`- EventCode`
Further improved Windows user creation rule * Decreased level * Fixed field names * Added false positive possibility 2019-04-21 21:54:18 +00:00			`- AccountName`
			`- AccountDomain`
fix: fixed missing date fields in remaining files 2020-01-30 15:07:37 +00:00			`falsepositives:`
New Sigma rule detecting local user creation 2019-04-18 17:59:43 +00:00			`- Domain Controller Logs`
Further improved Windows user creation rule * Decreased level * Fixed field names * Added false positive possibility 2019-04-21 21:54:18 +00:00			`- Local accounts managed by privileged account management tools`
			`level: low`