Suspicious Windows ANONYMOUS LOGON Local Account Created

Title: Suspicious Windows ANONYMOUS LOGON Local Account Created
Status: test
Description:Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an covering detection for exclusion of Logon Type 3 from ANONYMOUS LOGON accounts.
References:
  -https://twitter.com/SBousseaden/status/1189469425482829824
Author: James Pemberton / @4A616D6573
Date: 2019-10-31
modified:2022-10-09
Tags:

• -'attack.persistence'
• -'attack.t1136.001'
• -'attack.t1136.002'

Logsource:

• product: windows
• service: security

Detection:
  selection:
    EventID: '4720'
    SamAccountName|contains|all:
      -'ANONYMOUS'
      -'LOGON'

  condition:selection
Falsepositives:
  -Unknown
Level: high