title: Local User Creation
author: Patrick Bareiss
date: 2019/04/18
description: Detects local user creation on windows servers, which shouldn't happen
    in an Active Directory environment. Apply this Sigma Use Case on your windows
    server logs and not on your DC logs.
detection:
    SELECTION_1:
        EventID: 4720
    condition: SELECTION_1
falsepositives:
- Domain Controller Logs
- Local accounts managed by privileged account management tools
fields:
- EventCode
- AccountName
- AccountDomain
id: 66b6be3d-55d0-4f47-9855-d69df21740ea
level: low
logsource:
    product: windows
    service: security
modified: 2020/08/23
references:
- https://patrick-bareiss.com/detecting-local-user-creation-in-ad-with-sigma/
status: experimental
tags:
- attack.persistence
- attack.t1136
- attack.t1136.001
yml_filename: win_user_creation.yml
yml_path: /Users/user/Documents/YamatoSecurity/sigma/rules/windows/builtin

