Detection rules › Sigma

User account creation disguised in a computer account

Status
experimental
Severity
high
Log source
product windows, service security
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker creates a user account that fakes a computer account.

MITRE ATT&CK coverage

Event coverage

Rule body yaml

title: User account creation disguised in a computer account
description: Detects scenarios where an attacker creates a user account that fakes a computer account.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1136-Create%20account
- https://www.securonix.com/blog/securonix-threat-labs-security-advisory-threat-actors-target-mssql-servers-in-dbjammer-to-deliver-freeworld-ransomware/
tags:
- attack.persistence
- attack.t1098 # account manipulation
- attack.t1136 # user creation
- attack.defense_evesion
- attack.t0136 # masquerading
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:

  selection_creation:
    EventID: 4720 # User account creation
    TargetUserName|endswith: '$'

  selection_renamed:
    EventID: 4781 # User account name change
    NewTargetUserName|endswith: '$' 

  filter:
    OldTargetUserName|endswith: '$' 

  condition: selection_creation or (selection_renamed and not filter)
falsepositives:
- None
level: high

Stages and Predicates

Stage 0: condition

selection_creation or (selection_renamed and not filter)

Stage 1: selection_creation

selection_creation:
  EventID: 4720
  TargetUserName|endswith: '$'

Stage 2: selection_renamed

selection_renamed:
  EventID: 4781
  NewTargetUserName|endswith: '$'

Stage 3: not filter

filter:
  OldTargetUserName|endswith: '$'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
OldTargetUserNameends_with$

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
NewTargetUserNameends_with
  • $ corpus 2 (sigma 2)
TargetUserNameends_with
  • $ corpus 7 (sigma 5, kusto 2)