New or Renamed User Account with '$' Character

Severity: medium
Author: Ilyas Ochkov, oscd.community
Source: upstream

Detects the creation of a user with the "$" character. This can be used by attackers to hide a user or trick detection systems that lack the parsing mechanisms.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Evasion	`T1036` Masquerading

Event coverage

Provider	Event ID	Title
Security-Auditing	4720	A user account was created.
Security-Auditing	4781	The name of an account was changed.

Stages and Predicates

Stage 1: `1 of selection_create`

SamAccountName|contains: '$'

Stage 2: `1 of selection_rename`

NewTargetUserName|contains: '$'

Stage 3: `not 1 of filter_main_homegroup`

TargetUserName: 'HomeGroupUser$'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`NewTargetUserName`	match	`$`
`SamAccountName`	match	`$`
`TargetUserName`	eq	`HomeGroupUser$` corpus 2 (sigma 2)