From dd9648b31ef0ea23ffcb2c566de2449e8bcb59f5 Mon Sep 17 00:00:00 2001
From: Florian Roth <venom14@gmail.com>
Date: Sun, 21 Apr 2019 09:09:25 +0200
Subject: [PATCH] Revert "New Sigma rule detecting local user creation"

---
 rules/windows/builtin/win_user_creation.yml | 25 ---------------------
 1 file changed, 25 deletions(-)
 delete mode 100644 rules/windows/builtin/win_user_creation.yml

diff --git a/rules/windows/builtin/win_user_creation.yml b/rules/windows/builtin/win_user_creation.yml
deleted file mode 100644
index 99833a10a..000000000
--- a/rules/windows/builtin/win_user_creation.yml
+++ /dev/null
@@ -1,25 +0,0 @@
-title: Detects local user creation
-description: Detects local user creation on windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your windows server logs and not on your DC logs. 
-status: experimental
-tags:
-    - attack.persistence
-    - attack.t1136
-references:
-    - https://patrick-bareiss.com/detecting-local-user-creation-in-ad-with-sigma/ 
-author: Patrick Bareiss
-logsource:
-    product: windows
-    service: security
-detection:
-    selection:
-        EventID: 4720
-    condition: selection
-fields:
-    - EventCode
-    - Account_Name
-    - Account_Domain
-falsepositives: 
-    - Domain Controller Logs
-level: high
-
-