Detection rules › Sigma

Suspicious Windows ANONYMOUS LOGON Local Account Created

Severity
high
Author
James Pemberton / @4A616D6573
Source
upstream

Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an covering detection for exclusion of Logon Type 3 from ANONYMOUS LOGON accounts.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1136.001 Create Account: Local Account, T1136.002 Create Account: Domain Account

Event coverage

ProviderEvent IDTitle
Security-Auditing4720A user account was created.

Stages and Predicates

Stage 1: selection

SamAccountName|contains: ANONYMOUS
SamAccountName|contains: LOGON

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
SamAccountNamematch
  • ANONYMOUS
  • LOGON

Neighbors

Broader alternatives (more inclusive than this rule)

These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.