LoFP / legitimate local user creations may be done by a system or network administrator. verify whether this is known behavior in your environment. local user creations by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.

Techniques

• T1136

Sample rules

Windows User Account Creation

• source: elastic
• technicques:
  • T1136

Description

Identifies attempts to create a Windows User Account. This is sometimes done by attackers to persist or increase access to a system or domain.

Detection logic

host.os.type:windows and event.module:("system" or "security") and (event.code:"4720" or event.action:"added-user-account")