attack.t1136.001

Detects creation of a local user account using the net command with 'Admin' in the name - this technique is used by Vice Society ransomware gang to create bogus user accounts that attempt to blend in with an administrative user account naming convention.

Local User Creation

Jun 21, 2023 · attack.persistence attack.t1136.001 ·

Share on:

Detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your Windows server logs and not on your DC logs.

Serv-U Exploitation CVE-2021-35211 by DEV-0322

Jun 20, 2023 · attack.persistence attack.t1136.001 cve.2021.35211 detection.emerging_threats ·

Share on:

Detects patterns as noticed in exploitation of Serv-U CVE-2021-35211 vulnerability by threat group DEV-0322

Hidden Local User Creation

May 2, 2023 · attack.persistence attack.t1136.001 ·

Share on:

Detects the creation of a local hidden user account which should not happen for event ID 4720.

Creation Of A Local User Account

Feb 20, 2023 · attack.t1136.001 attack.persistence ·

Share on:

Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.

Default Account Usage

Jan 8, 2023 · attack.t1136 attack.t1136.001 ·

Share on:

Threat actor (APT35) created user, enabled it, set password, add to admins and remote desktop users.

Cisco Local Accounts

Jan 4, 2023 · attack.persistence attack.t1136.001 attack.t1098 ·

Share on:

Find local accounts being created or modified as well as remote authentication configurations

PowerShell Create Local User

Jan 4, 2023 · attack.execution attack.t1059.001 attack.persistence attack.t1136.001 ·

Share on:

Detects creation of a local user via PowerShell

Creation Of An User Account

Dec 20, 2022 · attack.t1136.001 attack.persistence ·

Share on:

Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.

Suspicious Windows ANONYMOUS LOGON Local Account Created

Oct 14, 2022 · attack.persistence attack.t1136.001 attack.t1136.002 ·

Share on:

Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an covering detection for exclusion of Logon Type 3 from ANONYMOUS LOGON accounts.