LoFP LoFP / it is possible that an administrator created the account. verifying activity with an administrator is advised. this analytic is set to anomaly to allow for risk to be added. filter and tune as needed. restrict to critical infrastructure to reduce any volume.

Techniques

Sample rules

Windows Create Local Account

Description

The following analytic identifies a new local user account added to a computer. Note that, this should be restricted to critical assets.

Detection logic


| tstats `security_content_summariesonly` values(All_Changes.result_id) as result_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Change where All_Changes.result_id=4720 by All_Changes.user All_Changes.dest All_Changes.result All_Changes.action 
| `drop_dm_object_name("All_Changes")` 
| `security_content_ctime(lastTime)` 
| `security_content_ctime(firstTime)` 
| `windows_create_local_account_filter`