Detection rules › Sigma
Local User Creation
Detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your Windows server logs and not on your DC logs.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1136.001 Create Account: Local Account |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Security-Auditing | 4720 | A user account was created. |
Stages and Predicates
Stage 1: selection
Neighbors
Stricter alternatives (narrower than this rule)
The rules below may be useful if you find the current rule is too noisy / lacks specificity.
- Suspicious Windows ANONYMOUS LOGON Local Account Created (adds 2 filters)
- Hidden Local User Creation (adds 1 filter)