LoFP / a legitimate new admin account being created

Techniques

• t1078
• t1078.004

Sample rules

Privileged Account Creation

• source: sigma
• technicques:
  • t1078
  • t1078.004

Description

Detects when a new admin is created.

Detection logic

condition: selection
selection:
  Status: Success
  properties.message|contains|all:
  - Add user
  - Add member to role