Detection rules › Sigma
Hidden account creation (with fast deletion)
Detects scenarios where an attacker creates a hidden local account. See also rule "User account creation disguised in a computer account".
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1098 Account Manipulation, T1136 Create Account |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4720 | A user account was created. |
| Security-Auditing | Event ID 4726 | A user account was deleted. |
Rule body yaml
title: Hidden account creation (with fast deletion)
description: Detects scenarios where an attacker creates a hidden local account. See also rule "User account creation disguised in a computer account".
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1136-Create%20account
- https://github.com/wgpsec/CreateHiddenAccount
tags:
- attack.persistence
- attack.t1098 # account manipulation
- attack.t1136 # user creation
- attack.defense_evesion
- attack.t0136 # masquerading
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: security
detection:
selection_create:
EventID: 4720
selection_delete:
EventID: 4726
filter:
Computer: '%domain_controllers%'
condition: selection_create and selection_delete and not filter # requires grouping over 'TargetSid' to not mix different user accounts
timeframe: 1m
falsepositives:
- IAM account lifecycle software
level: medium
Stages and Predicates
Stage 0: condition
selection_create and selection_delete and not filter # requires grouping over 'TargetSid' to not mix different user accountsStage 1: selection_create
selection_create:
EventID: 4720
Stage 2: selection_delete
selection_delete:
EventID: 4726
Stage 3: not filter
filter:
Computer: '%domain_controllers%'
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
Computer | eq | %domain_controllers% |