splApache-2.0from splunk/security_content

Windows Create Local Account

The following analytic detects the creation of a new local user account on a Windows system. It leverages Windows Security Audit logs, specifically event ID 4720, to identify this activity. Monitoring the creation of local accounts is crucial for a SOC as it can indicate unauthorized access or lateral movement within the network. If confirmed malicious, this activity could allow an attacker to establish persistence, escalate privileges, or gain unauthorized access to sensitive systems and data.

Quality

FP risk

—

Forks

Views

Rule sourcedetections/endpoint/windows_create_local_account.yml

| tstats `security_content_summariesonly`
  values(All_Changes.result_id) as result_id
  count min(_time) as firstTime
        max(_time) as lastTime
from datamodel=Change where
All_Changes.result_id=4720
by All_Changes.user All_Changes.dest All_Changes.result All_Changes.action
| `drop_dm_object_name("All_Changes")`
| `security_content_ctime(lastTime)`
| `security_content_ctime(firstTime)`
| `windows_create_local_account_filter`