Detection rules › Splunk
Create_Add Local_Domain User (Sysmon)
Detects the addition of a nonprivileged user that is added to a privileged local or domain group, or when a user is created
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1098 Account Manipulation, T1136.001 Create Account: Local Account, T1136.002 Create Account: Domain Account |
| Privilege Escalation | T1098 Account Manipulation |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
Rule body yaml
id: '1025.1025'
title: Create_Add Local_Domain User
description: 'Detects the addition of a nonprivileged user that is added to a privileged
local or domain group, or when a user is created. -- Threat Actor Association: Alloy
Taurus/Gallium, APT29, APT35/Phosphorus/Magic Hound, CL-STA-0043, DarkSide, BlackMatter,
FIN12, Lapsus$, Lazarus, Phosphorus/Magic Hound/APT35, UNC2596 -- Software Association:
Akira, Avos, Bazarloader, BianLian, Blackbyte, Blackcat/ALPHV, Cactus, Conti, Cring,
Cuba, Hafnium, Insekt, Lockbit, Qakbot/Qbot, Royal, SmokedHAM, TargetCompany, Trigona,
Vice Society - Atomics T1078.003 Test#1 Atomics T1136.001 Test#3 Atomics T1136.001
Test#4 Atomics T1136.001 Test#6 Atomics T1136.002 Test#1 Atomics T1136.002 Test#2
Atomics T1136.002 Test#3'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_sysmon` EventCode=1 "net.exe" AND
("add" OR "remote") | rename hashes as file_hash | table _time, host, user event_id,
file_hash, parent_process, parent_process_id, parent_process_name, parent_process_path,
process, process_current_directory, process_id, process_name, process_path, signature_id,
user_id | bin span=120s | stats values(*) as * by _time, host | where match(process,"(?i).add")
AND match(process,"(?i)(\-u)|(user)|(localgroup)|(group)") '
techniques:
- persistence:account manipulation
- persistence:create account:local account
- persistence:create account:domain account
technique_id:
- T1098
- T1136.002
- T1136.001
data_category:
- Windows Sysmon
references:
- https://www.sans.org/reading-room/whitepapers/logging/paper/37367
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` EventCode=1 "net.exe" AND ("add" OR "remote")
Stage 2: rename
| rename hashes as file_hash
Stage 3: table
| table _time, host, user event_id, file_hash, parent_process, parent_process_id, parent_process_name, parent_process_path, process, process_current_directory, process_id, process_name, process_path, signature_id, user_id
Stage 4: bucket
| bin span=120s
Stage 5: stats
| stats values(*) as * by _time, host
Stage 6: where
| where match(process,"(?i).add") AND match(process,"(?i)(\-u)|(user)|(localgroup)|(group)")
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | "net.exe" |
| 1 | "add" |
| 1 | "remote" |