Suspicious Windows ANONYMOUS LOGON Local Account Created

Status: test
Severity: high
Log source: product windows, service security
Author: James Pemberton / @4A616D6573
Source: github.com/SigmaHQ/sigma

Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an covering detection for exclusion of Logon Type 3 from ANONYMOUS LOGON accounts.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1136.001` Create Account: Local Account `T1136.002` Create Account: Domain Account

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4720: A user account was created.

Rule body

title: Suspicious Windows ANONYMOUS LOGON Local Account Created
id: 1bbf25b9-8038-4154-a50b-118f2a32be27
status: test
description: Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an covering detection for exclusion of Logon Type 3 from ANONYMOUS LOGON accounts.
references:
    - https://twitter.com/SBousseaden/status/1189469425482829824
author: James Pemberton / @4A616D6573
date: 2019-10-31
modified: 2022-10-09
tags:
    - attack.persistence
    - attack.t1136.001
    - attack.t1136.002
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4720
        SamAccountName|contains|all:
            - 'ANONYMOUS'
            - 'LOGON'
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    EventID: 4720
    SamAccountName|contains|all:
        - 'ANONYMOUS'
        - 'LOGON'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`SamAccountName`	match	`ANONYMOUS` `LOGON`	`field:"SamAccountName" kind:match`