Windows User Account Creation

edit

Identifies attempts to create a Windows User Account. This is sometimes done by attackers to persist or increase access to a system or domain.

Rule type: query

Rule indices:

  • winlogbeat-*
  • logs-system.*
  • logs-windows.*

Severity: low

Risk score: 21

Runs every: 5m

Searches indices from: None (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References: None

Tags:

  • Domain: Endpoint
  • OS: Windows
  • Use Case: Threat Detection
  • Tactic: Persistence

Version: 1

Rule authors:

  • Skoetting

Rule license: Elastic License v2

Rule query

edit
event.module:("system" or "security") and winlog.api:"wineventlog" and
  (event.code:"4720" or event.action:"added-user-account")

Framework: MITRE ATT&CKTM