{"id":"cfeed607-6aa4-4bbd-9627-b637deb723c8","title":"New or Renamed User Account with '$' Character","description":"Detects the creation of a user with the \"$\" character. This can be used by attackers to hide a user or trick detection systems that lack the parsing mechanisms.\n","author":"Ilyas Ochkov, oscd.community","status":"test","level":"medium","date":"2019-10-25","modified":"2024-01-16","tags":["attack.stealth","attack.t1036"],"technique_ids":["T1036"],"logsource":{"product":"windows","service":"security"},"falsepositives":["Unknown"],"references":["https://twitter.com/SBousseaden/status/1387743867663958021"],"source_path":"rules/windows/builtin/security/win_security_new_or_renamed_user_account_with_dollar_sign.yml","source_sha256":"b6c0b0480d29657c914dd954a6e581cb2c9bad347231f8461a21dca50e89522b","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_new_or_renamed_user_account_with_dollar_sign.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: New or Renamed User Account with '$' Character\nid: cfeed607-6aa4-4bbd-9627-b637deb723c8\nstatus: test\ndescription: |\n    Detects the creation of a user with the \"$\" character. This can be used by attackers to hide a user or trick detection systems that lack the parsing mechanisms.\nreferences:\n    - https://twitter.com/SBousseaden/status/1387743867663958021\nauthor: Ilyas Ochkov, oscd.community\ndate: 2019-10-25\nmodified: 2024-01-16\ntags:\n    - attack.stealth\n    - attack.t1036\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection_create:\n        EventID: 4720 # create user\n        SamAccountName|contains: '$'\n    selection_rename:\n        EventID: 4781 # rename user\n        NewTargetUserName|contains: '$'\n    filter_main_homegroup:\n        EventID: 4720\n        TargetUserName: 'HomeGroupUser$'\n    condition: 1 of selection_* and not 1 of filter_main_*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1036","id":"T1036","name":"Masquerading","page":"techniques/enterprise/T1036/"}],"data_path":"data/detection-rules/cfeed607-6aa4-4bbd-9627-b637deb723c8.json","kind":"sigma"}