Hidden Local User Creation
Detects the creation of a local hidden user account which should not happen for event ID 4720.
Sigma rule (View on GitHub)
1title: Hidden Local User Creation 2id: 7b449a5e-1db5-4dd0-a2dc-4e3a67282538 3status: test 4description: Detects the creation of a local hidden user account which should not happen for event ID 4720. 5references: 6 - https://twitter.com/SBousseaden/status/1387743867663958021 7author: Christian Burkard (Nextron Systems) 8date: 2021/05/03 9modified: 2022/10/09 10tags: 11 - attack.persistence 12 - attack.t1136.001 13logsource: 14 product: windows 15 service: security 16detection: 17 selection: 18 EventID: 4720 19 TargetUserName|endswith: '$' 20 condition: selection 21falsepositives: 22 - Unknown 23level: high