Detection rules › Splunk
Create_Add Local_Domain User (Sysmon)
Detects the addition of a nonprivileged user that is added to a privileged local or domain group, or when a user is created
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | |
| Privilege Escalation |
References
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule body
id: '1025.1025'
title: Create_Add Local_Domain User
description: 'Detects the addition of a nonprivileged user that is added to a privileged
local or domain group, or when a user is created. -- Threat Actor Association: Alloy
Taurus/Gallium, APT29, APT35/Phosphorus/Magic Hound, CL-STA-0043, DarkSide, BlackMatter,
FIN12, Lapsus$, Lazarus, Phosphorus/Magic Hound/APT35, UNC2596 -- Software Association:
Akira, Avos, Bazarloader, BianLian, Blackbyte, Blackcat/ALPHV, Cactus, Conti, Cring,
Cuba, Hafnium, Insekt, Lockbit, Qakbot/Qbot, Royal, SmokedHAM, TargetCompany, Trigona,
Vice Society - Atomics T1078.003 Test#1 Atomics T1136.001 Test#3 Atomics T1136.001
Test#4 Atomics T1136.001 Test#6 Atomics T1136.002 Test#1 Atomics T1136.002 Test#2
Atomics T1136.002 Test#3'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_sysmon` EventCode=1 "net.exe" AND
("add" OR "remote") | rename hashes as file_hash | table _time, host, user event_id,
file_hash, parent_process, parent_process_id, parent_process_name, parent_process_path,
process, process_current_directory, process_id, process_name, process_path, signature_id,
user_id | bin span=120s | stats values(*) as * by _time, host | where match(process,"(?i).add")
AND match(process,"(?i)(\-u)|(user)|(localgroup)|(group)") '
techniques:
- persistence:account manipulation
- persistence:create account:local account
- persistence:create account:domain account
technique_id:
- T1098
- T1136.002
- T1136.001
data_category:
- Windows Sysmon
references:
- https://www.sans.org/reading-room/whitepapers/logging/paper/37367
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` EventCode=1 "net.exe" AND ("add" OR "remote")
Stage 2: rename
| rename hashes as file_hash
Stage 3: table
| table _time, host, user event_id, file_hash, parent_process, parent_process_id, parent_process_name, parent_process_path, process, process_current_directory, process_id, process_name, process_path, signature_id, user_id
Stage 4: bucket
| bin span=120s
Stage 5: stats
| stats values(*) as * by _time, host
Stage 6: where
| where match(process,"(?i).add") AND match(process,"(?i)(\-u)|(user)|(localgroup)|(group)")
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq value:"1" |
process | regex_match |
| field:"CommandLine" kind:regex_match |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "net.exe" |
| 1 | "add" |
| 1 | "remote" |