rules/windows/builtin/win_user_creation.yml

title: Detects local user creation
id: 66b6be3d-55d0-4f47-9855-d69df21740ea
description: Detects local user creation on windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your windows
    server logs and not on your DC logs.
status: experimental
tags:
    - attack.persistence
    - attack.t1136
references:
    - https://patrick-bareiss.com/detecting-local-user-creation-in-ad-with-sigma/
author: Patrick Bareiss
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4720
    condition: selection
fields:
    - EventCode
    - AccountName
    - AccountDomain
falsepositives: 
    - Domain Controller Logs
    - Local accounts managed by privileged account management tools
level: low
New Sigma rule detecting local user creation 2019-04-18 19:59:43 +02:00			`title: Detects local user creation`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`id: 66b6be3d-55d0-4f47-9855-d69df21740ea`
			`description: Detects local user creation on windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your windows`
			`server logs and not on your DC logs.`
Modified rule 2019-04-21 00:14:57 +02:00			`status: experimental`
New Sigma rule detecting local user creation 2019-04-18 19:59:43 +02:00			`tags:`
Modified rule 2019-04-21 00:14:57 +02:00			`- attack.persistence`
			`- attack.t1136`
New Sigma rule detecting local user creation 2019-04-18 19:59:43 +02:00			`references:`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`- https://patrick-bareiss.com/detecting-local-user-creation-in-ad-with-sigma/`
New Sigma rule detecting local user creation 2019-04-18 19:59:43 +02:00			`author: Patrick Bareiss`
			`logsource:`
			`product: windows`
			`service: security`
			`detection:`
			`selection:`
			`EventID: 4720`
			`condition: selection`
			`fields:`
			`- EventCode`
Further improved Windows user creation rule 2019-04-21 23:54:18 +02:00			`- AccountName`
			`- AccountDomain`
New Sigma rule detecting local user creation 2019-04-18 19:59:43 +02:00			`falsepositives:`
			`- Domain Controller Logs`
Further improved Windows user creation rule 2019-04-21 23:54:18 +02:00			`- Local accounts managed by privileged account management tools`
			`level: low`
New Sigma rule detecting local user creation 2019-04-18 19:59:43 +02:00