new rules detecting the creation of a local hidden user

rules/windows/builtin/win_hidden_user_creation.yml

@@ -0,0 +1,25 @@
+title: Hidden Local User Creation
+id: 7b449a5e-1db5-4dd0-a2dc-4e3a67282538
+description: Detects the creation of a local hidden user account which should not happen for event ID 4720.
+status: experimental
+tags:
+    - attack.persistence
+    - attack.t1136.001
+references:
+  - https://twitter.com/SBousseaden/status/1387743867663958021
+author: Christian Burkard
+date: 2021/05/03
+logsource:
+    product: windows
+    service: security
+detection:
+    selection:
+        EventID: 4720
+        TargetUserName|endswith: '$'
+    condition: selection
+fields:
+    - EventCode
+    - AccountName
+falsepositives:
+    - unkown
+level: high

rules/windows/registry_event/sysmon_registry_add_local_hidden_user.yml

@@ -0,0 +1,23 @@
+title: Creation of a local hidden user account by Registry
+id: 460479f3-80b7-42da-9c43-2cc1d54dbccd
+description: Sysmon registry detection of a local hidden user account.
+status: experimental
+date: 2021/05/03
+author: Christian Burkard
+tags:
+    - attack.persistence
+    - attack.t1136.001
+references:
+    - https://twitter.com/SBousseaden/status/1387530414185664538
+logsource:
+    product: windows
+    service: registry_event
+detection:
+    selection:
+        TargetObject|startswith: 'HKLM\SAM\SAM\Domains\Account\Users\Names\'
+        TargetObject|endswith: '$'
+        Image|endswith: "lsass.exe"
+    condition: selection
+falsepositives:
+    - unknown
+level: high