title: Local User Creation
ruletype: Sigma
author: Patrick Bareiss
date: 2019/04/18
description: Detects local user creation on windows servers, which shouldn't happen
  in an Active Directory environment. Apply this Sigma Use Case on your windows server
  logs and not on your DC logs.
detection:
  SELECTION_1:
    provider_Name: Microsoft-Windows-Security-Auditing
  SELECTION_2:
    EventID: 4720
  condition: (SELECTION_1 and SELECTION_2)
falsepositives:
- Domain Controller Logs
- Local accounts managed by privileged account management tools
fields:
- EventCode
- AccountName
- AccountDomain
id: 66b6be3d-55d0-4f47-9855-d69df21740ea
level: low
logsource:
  product: windows
  service: security
modified: 2021/11/30
references:
- https://patrick-bareiss.com/detecting-local-user-creation-in-ad-with-sigma/
status: test
tags:
- attack.persistence
- attack.t1136
- attack.t1136.001