author: Eric Conrad, Yamato Security
creation_date: 2020/11/08
uodated_date:  2021/11/26

title: Hidden user account created! (Possible Backdoor)
title_jp: 隠しユーザアカウントが作成された！（バックドアの可能性あり）
output: 'User: %TargetUserName%  :  SID:%TargetSid%'
output_jp: 'ユーザ名: %TargetUserName%  :  SID:%TargetSid%'
description: A computer account (an account that ends with a $) was created. These accounts are not displayed by default so will be hidden.
description_jp: A computer account (an account that ends with a $) was created. These accounts are not displayed by default so will be hidden.

id: 70b8b1bd-c107-4b1a-8b1e-5b0f9f57930a
level: high
status: stable
detection:
    selection:
        Channel: Security
        EventID: 4720
        TargetUserName|endswith: "$"
falsepositives:
    - domain controller
tags:
    - attack.persistence
    - attack.11136.001
references:
    - https://attack.mitre.org/techniques/T1136/001/
sample-evtx: ./sample-evtx/EVTX-to-MITRE-Attack/TA0003-Persistence/T1136-Create account/ID4720-Fake computer account created.evtx
ruletype: hayabusa