Detection rules › Splunk
Create_Add Local_Domain User (EDR)
Detects the addition of a nonprivileged user that is added to a privileged local or domain group, or when a user is created
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1098 Account Manipulation, T1136.001 Create Account: Local Account, T1136.002 Create Account: Domain Account |
| Privilege Escalation | T1098 Account Manipulation |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
id: '1025.14323'
title: Create_Add Local_Domain User
description: 'Detects the addition of a nonprivileged user that is added to a privileged
local or domain group, or when a user is created. -- Threat Actor Association: Alloy
Taurus/Gallium, APT29, APT35/Phosphorus/Magic Hound, CL-STA-0043, DarkSide, BlackMatter,
FIN12, Lapsus$, Lazarus, Phosphorus/Magic Hound/APT35, UNC2596 -- Software Association:
Akira, Avos, Bazarloader, BianLian, Blackbyte, Blackcat/ALPHV, Cactus, Conti, Cring,
Cuba, Hafnium, Insekt, Lockbit, Qakbot/Qbot, Royal, SmokedHAM, TargetCompany, Trigona,
Vice Society - Atomics T1078.003 Test#1 Atomics T1136.001 Test#3 Atomics T1136.001
Test#4 Atomics T1136.001 Test#6 Atomics T1136.002 Test#1 Atomics T1136.002 Test#2
Atomics T1136.002 Test#3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_edr` ((event_type IN ("childproc","netconn","proc"))
OR (TERM(ProcessRollup2) OR Type=Process) OR TERM(DeviceProcessEvents)) "DeviceProcessEvents"
AND "net.exe" AND "add" | rex field=process "(?i)net.*?user(.*?add)?\s+(?<dest_user1>\S+")|
rex field=process "(?i)net.*?group\s+(?<user_group1>\S+")| rex field=process "(?i)net.*?group\s+\S+\s+(?<dest_user2>\S+")|
eval user_group=coalesce(user_group,user_group1), dest_user=coalesce(dest_user1,
dest_user2, dest_user, user) | table _time, host, user dvc, dvc_nt_host, event_id,
host, index, parameters, parent_process_id, parent_process_name, parent_process_path,
process, process_id, process_name, process_path, signature_id, source, sourcetype,
tag, user, user_group, dest_user | bin span=1s | stats values(*) as * by _time,
host | where(match(process,"(?i).add") ANDmatch(process,"(?i)(\-u)|(user)|(localgroup)|(group)"))
OR (match(user_group,"(?i)(users)|(administrators)|(remote)")) ORmatch(signature_id,"(?i)4720")
`hec_collect`'
techniques:
- persistence:account manipulation
- persistence:create account:local account
- persistence:create account:domain account
technique_id:
- T1098
- T1136.002
- T1136.001
data_category:
- EDR Logs
- Process command-line parameters
references:
- https://www.sans.org/reading-room/whitepapers/logging/paper/37367
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_edr` ((event_type IN ("childproc","netconn","proc")) OR (TERM(ProcessRollup2) OR Type=Process) OR TERM(DeviceProcessEvents)) "DeviceProcessEvents" AND "net.exe" AND "add"
Stage 2: eval
| rex field=process "(?i)net.*?user(.*?add)?\s+(?<dest_user1>\S+")
Stage 3: eval
| rex field=process "(?i)net.*?group\s+(?<user_group1>\S+")
Stage 4: eval
| rex field=process "(?i)net.*?group\s+\S+\s+(?<dest_user2>\S+")
Stage 5: eval
| eval user_group=coalesce(user_group,user_group1), dest_user=coalesce(dest_user1, dest_user2, dest_user, user)
Stage 6: table
| table _time, host, user dvc, dvc_nt_host, event_id, host, index, parameters, parent_process_id, parent_process_name, parent_process_path, process, process_id, process_name, process_path, signature_id, source, sourcetype, tag, user, user_group, dest_user
Stage 7: bucket
| bin span=1s
Stage 8: stats
| stats values(*) as * by _time, host
Stage 9: where
| where(match(process,"(?i).add") ANDmatch(process,"(?i)(\-u)|(user)|(localgroup)|(group)")) OR (match(user_group,"(?i)(users)|(administrators)|(remote)")) ORmatch(signature_id,"(?i)4720") `hec_collect`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
event_type | in |
|
process | match |
|
signature_id | match |
|
user_group | match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | ProcessRollup2 |
| 1 | TERM |
| 1 | DeviceProcessEvents |
| 1 | "DeviceProcessEvents" |
| 1 | "net.exe" |
| 1 | "add" |