
title: New or Renamed User Account with '$' in Attribute 'SamAccountName'.
author: Ilyas Ochkov, oscd.community
date: 2019/10/25
description: Detects possible bypass EDR and SIEM via abnormal user account name.
detection:
  SELECTION_1:
    EventID: 4720
  SELECTION_2:
    EventID: 4781
  SELECTION_3:
    SamAccountName: '*$*'
  condition: ((SELECTION_1 or SELECTION_2) and SELECTION_3)
falsepositives:
- Unknown
fields:
- EventID
- SamAccountName
- SubjectUserName
id: cfeed607-6aa4-4bbd-9627-b637deb723c8
level: high
logsource:
  product: windows
  service: security
modified: 2021/07/07
status: experimental
tags:
- attack.defense_evasion
- attack.t1036
ruletype: SIGMA
