Title:Hidden Local User Creation Status:test Description:Detects the creation of a local hidden user account which should not happen for event ID 4720. References: -https://twitter.com/SBousseaden/status/1387743867663958021 Author: Christian Burkard (Nextron Systems) Date: 2021-05-03 modified:2024-01-16 Tags:
-'attack.persistence'
-'attack.t1136.001'
Logsource:
product: windows
service: security
Detection: selection: EventID:
'4720' TargetUserName|endswith:
'$' filter_main_homegroup: TargetUserName:
'HomeGroupUser$' condition:selection and not 1 of filter_main_* Falsepositives:
-Unknown Level:high
