attack.t1136.001

Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.

Creation Of An User Account

Aug 12, 2024 · attack.t1136.001 attack.persistence ·

Share on:

Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.

Hidden Local User Creation

Aug 12, 2024 · attack.persistence attack.t1136.001 ·

Share on:

Detects the creation of a local hidden user account which should not happen for event ID 4720.

Local User Creation

Aug 12, 2024 · attack.persistence attack.t1136.001 ·

Share on:

Detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your Windows server logs and not on your DC logs.

New User Created Via Net.EXE

Aug 12, 2024 · attack.persistence attack.t1136.001 ·

Share on:

Identifies the creation of local users via the net.exe command.

New User Created Via Net.EXE With Never Expire Option

Aug 12, 2024 · attack.persistence attack.t1136.001 ·

Share on:

Detects creation of local users via the net.exe command with the option "never expire"

PowerShell Create Local User

Aug 12, 2024 · attack.execution attack.t1059.001 attack.persistence attack.t1136.001 ·

Share on:

Detects creation of a local user via PowerShell

Serv-U Exploitation CVE-2021-35211 by DEV-0322

Aug 12, 2024 · attack.persistence attack.t1136.001 cve.2021-35211 detection.emerging-threats ·

Share on:

Detects patterns as noticed in exploitation of Serv-U CVE-2021-35211 vulnerability by threat group DEV-0322

Suspicious Windows ANONYMOUS LOGON Local Account Created

Aug 12, 2024 · attack.persistence attack.t1136.001 attack.t1136.002 ·

Share on:

Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an covering detection for exclusion of Logon Type 3 from ANONYMOUS LOGON accounts.

User Added to Remote Desktop Users Group

Aug 12, 2024 · attack.persistence attack.lateral-movement attack.t1133 attack.t1136.001 attack.t1021.001 ·

Share on:

Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember".

Default Account Usage

Aug 2, 2024 · attack.t1136 attack.t1136.001 ·

Share on:

Threat actor (APT35) created user, enabled it, set password, add to admins and remote desktop users.

Suspicious 'Admin' Local User Creation with Net Command

Sep 1, 2023 · attack.persistence attack.privilege_escalation attack.t1136.001 attack.t1136 attack.t1078 attack.t1078.003 ·

Share on:

Detects creation of a local user account using the net command with 'Admin' in the name - this technique is used by Vice Society ransomware gang to create bogus user accounts that attempt to blend in with an administrative user account naming convention.