Hidden Local User Creation — Sigma Rule

Rule metadata and linked tags

Author: Christian Burkard (Nextron Systems). Source status: test; severity: high. Source dates: 2021-05-03 / 2024-01-16.

{
  "product": "windows",
  "service": "security"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: f455ebd3c6ea873c0e9ac3c059b3a0a62200fea73674ea4080c111b4325846d3

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Hidden Local User Creation
id: 7b449a5e-1db5-4dd0-a2dc-4e3a67282538
status: test
description: Detects the creation of a local hidden user account which should not happen for event ID 4720.
references:
    - https://twitter.com/SBousseaden/status/1387743867663958021
author: Christian Burkard (Nextron Systems)
date: 2021-05-03
modified: 2024-01-16
tags:
    - attack.persistence
    - attack.t1136.001
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4720
        TargetUserName|endswith: '$'
    filter_main_homegroup:
        TargetUserName: 'HomeGroupUser$'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high

Original YAML and metadata in JSON

False positives

• Unknown

Source references

• https://twitter.com/SBousseaden/status/1387743867663958021