Techniques
Sample rules
Windows Create Local Account
- source: splunk
- technicques:
- T1136.001
- T1136
Description
The following analytic identifies a new local user account added to a computer. Note that, this should be restricted to critical assets.
Detection logic
| tstats `security_content_summariesonly` values(All_Changes.result_id) as result_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Change where All_Changes.result_id=4720 by All_Changes.user All_Changes.dest All_Changes.result All_Changes.action
| `drop_dm_object_name("All_Changes")`
| `security_content_ctime(lastTime)`
| `security_content_ctime(firstTime)`
| `windows_create_local_account_filter`