1200kmSECURITY RESEARCH

1200KM / sigma-rule

Local User Creation — Sigma Rule

Sigma rule 66b6be3d-55d0-4f47-9855-d69df21740ea. Local User Creation — Sigma Rule. Detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your Windows server logs and not on your DC logs.

Rule metadata and linked tags

testlowwindowssecurityattack.persistenceattack.t1136.001

Author: Patrick Bareiss. Source status: test; severity: low. Source dates: 2019-04-18 / 2021-01-17.

{
  "product": "windows",
  "service": "security"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 07e4a4b8899f265946a0f17b524526e3350fb64e0a6751975272df84ef96df85

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Local User Creation
id: 66b6be3d-55d0-4f47-9855-d69df21740ea
status: test
description: |
    Detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your Windows server logs and not on your DC logs.
references:
    - https://patrick-bareiss.com/detecting-local-user-creation-in-ad-with-sigma/
author: Patrick Bareiss
date: 2019-04-18
modified: 2021-01-17
tags:
    - attack.persistence
    - attack.t1136.001
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4720
    condition: selection
falsepositives:
    - Domain Controller Logs
    - Local accounts managed by privileged account management tools
level: low

Original YAML and metadata in JSON

False positives

  • Domain Controller Logs
  • Local accounts managed by privileged account management tools

Source references

Connected ecosystem references

Exact source-tagged techniques

Telemetry review

Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.